feat(syntax): share one node path API between css and html - #22569

`path.stop()` ends the walk in both languages: no visitor fires after
the current one, as in Babel. A print still writes the whole output; a
walk-only parse stops parsing at the next safe point. `use()` takes an
array of node types for one visitor, resolved once at registration.
Document the comparison with Babel's NodePath as the roadmap.

Drop `range` (`start`/`end` say the same without an array), fold
`sourceSlice` into `source(start, end)`, and replace `children` /
`childAt` with `child(i, n)`, 0 past the end in both languages. HTML
keeps a per-parent cursor so a loop over `child` steps one link per
child; its tree links and CSS's child lists move off the path.

`name` and `value` return what the language's spec defines, as ESTree's
`Identifier.name` and `Literal.value` do: CSS resolves escapes (folding
`unescapedName`, `unescaped`, `atKeyword`), HTML folds `data`,
`doctypeName` and `piTarget` and answers "" for a node without one.
The written spelling is `source(nameStart, nameEnd)`; a url's contents
are `valueStart`/`valueEnd`, and the doctype ids `publicId`/`systemId`.

An attribute is a node with a negative id, as `Attr` is in the DOM and
`JSXAttribute` in ESTree: `name`, `value` (decoded), `source`,
`start`/`end`, `nameStart`/`nameEnd`, `valueStart`/`valueEnd` and
`loc` read it, and `type` answers `NodeType.Attribute`. Only
`attributeCount`, `attribute(i, n)` and `findAttribute` stay
attribute-specific; `tagEnd` folds into `contentStart`.

…ends

An element closed by a later start tag spanned that tag, one closed by an
ancestor's end tag or end of input stopped at its own start tag. It now
ends where the closing token starts (never before its own tag or last
child), and only the element an end tag names spans that tag. CSS
`name`, `nameStart`/`nameEnd` and `blockToken` answer "" or -1 on a
node that has none instead of reading another node's slot.

One table for the shared members with the CSS, HTML and ESTree meaning of
each, the shape language-specific members follow, and the conventions a
JavaScript path will keep.

`value` returns what CSS Syntax defines: a number for a number,
percentage or dimension (its unit through `unit`), a comment's text
without its delimiters. `source` slices the caller's input, so a NUL or
an escape the input ran out of reads as written; the printer keeps its
resolved reading internally.

Move the child cursor's epoch to where the tree under a walk changes
(parse start, streamed sync and flush) instead of every dispatch, and
end a popped element out of line so `popOpen` stays small.

Instead of a flag checked after every visitor call, `stop()` empties the
compiled visitor lists in place, so a running loop ends after the visitor
that asked and none fires again; the grammar puts them back when the
parse ends. The loops are what they were before `stop()` existed.

`range` replaces `start`/`end`, and `nameRange`, `valueRange`,
`blockRange` and `contentRange` replace each start/end pair, as acorn's
`range`; a node without the part answers null. `loc` returns
`[line, column, endLine, endColumn]`. CSS `childRules` is `rules`,
beside `declarations`. HTML `contentRange` reaches the end tag on every
element. The parsers and printers keep scalar readers, so only a caller
asking for a range allocates one.

…ment

The adoption agency and the generic end-tag rule write the element's end
before popping it, and `popOpen` then recomputed it from the token's
start, so `<b>b</b>` and `<span>s</span>` ended before their end tag.
A popped element now never ends before what it already holds.

The CSS minifier gained readers written against `unescapedName`,
`start` and `childAt`; they now read `name`, the scalar `_startOf` and
`child(i, n)`, and the two that unescape a name themselves read
`_rawName` so their output is unchanged.

…l5lib cases