[WIP] test: switch to karma for testing - #1805

## Summary

Adds `aria-actions` to axe-core's known ARIA attributes so it is
recognized as valid, allowed, and prohibited on the roles the spec
prohibits it on — and re-enables the APG `tabs-actions` example that had
been disabled for lack of `aria-actions` support.

Per the [spec draft](w3c/aria#1805),
`aria-actions`:

- **Value type:** ID reference list → `idrefs`
- **Global:** yes (like `aria-describedby`)
- **Empty allowed:** yes — the spec permits `aria-actions=""` (the
deferred-DOM case) → `allowEmpty: true`
- **Prohibited roles:** the name-prohibited roles the spec also
prohibits it on (all axe `prohibitedAttrs` roles except
`none`/`presentation`, which the spec still permits)
- **ElementInternals reflection:** `ariaActionsElements`

## Accessibility-supported rationale

Following the [Impact on
ARIA](https://github.com/dequelabs/axe-core/blob/develop/doc/accessibility-supported.md#impact-on-aria)
decision framework:

1. Supported by all platforms? No — shipped in WebKit and Firefox;
**Chromium pending**.
2. Does its use negatively impact accessibility? **No** — unsupported
browsers simply ignore the attribute (progressive enhancement), and the
spec hard-guards exposure. → **allow.**

> **Note for reviewers:** the ARIA spec change is still [PR
#1805](w3c/aria#1805), not yet merged — this
aligns to the two engines shipping ahead of spec approval. We can patch
the config later in the unlikely event the spec shifts.

## Changes

**Attribute recognition** — `lib/standards/aria-attrs.js`: add the
`aria-actions` entry (`idrefs`, global, `allowEmpty`).

**Prohibited-on-role** — `lib/standards/aria-roles.js`: add
`aria-actions` to `prohibitedAttrs` for `caption`, `code`, `deletion`,
`emphasis`, `insertion`, `mark`, `paragraph`, `strong`, `subscript`,
`superscript`, `suggestion`. Per
[w3c/aria#1805](w3c/aria#1805) these roles
prohibit it; `none`/`presentation` do not, so they are left unchanged.

**APG test re-enable (Closes #4584)** — bump `aria-practices` to latest
`main` (the `tabs-actions` page did not exist at the previously pinned
commit) and remove it from `skippedPages`. axe recognizes the attribute
but not the authoring *pattern*, so `aria-required-children`
(tabs-actions) and `nested-interactive` (listbox-actions) are disabled
per-page pending #5215.

**Review feedback** — update the stale `wai-aria-1.1` `Source:` comment
to the unversioned WAI-ARIA URL; add an `aria-actions=""` pass case
exercising `allowEmpty`.

## Testing

- `get-global-aria-attrs`, `aria-prohibited-attr` (check +
virtual-rule), `aria-valid-attr`, `aria-allowed-attr`,
`aria-valid-attr-value` unit + integration tests ✓
- Full APG suite green (76 passing) ✓
- `npm run build` clean; no auto-generated committed files change

## Follow-ups

- #5215 — teach `aria-required-children` / `nested-interactive` about
the `aria-actions` pattern, then remove the per-page disables in
`apg.spec.js`

Closes #5199
Closes #4584