feat: declare vendored modules and check the document schema

[mcanouil]

The five shared Lua modules move from _modules/ to _vendor/quarto-lua-modules/, and _dependencies.yml now names the release each one came from, so every file can be checked against its source.
The entry point is repointed accordingly and nothing is left under _modules/.
The extension also checks the document configuration against _schema.yml and reports what the schema does not accept.
The check runs from the shortcode handler, because the extension contributes a shortcode and no filter.
It only reports: it never alters the document and never stops a render.

The documentation render is clean and exits 0, with no missing module and no error.

One thing is worth a look before this is released.
The validation reports six warnings per page on this site, of the form 1: is not a recognised key and was ignored., one per entry of the badge array.
The cause is a mismatch between where _schema.yml says the options live and where the extension reads them.
The schema declares badge and badge-overrides as options of the extension, which places them at extensions.badge.badge and extensions.badge.badge-overrides.
The extension instead reads extensions.badge as the badge array itself, and badge-overrides from the top level or from extensions.badge-overrides.
The validator therefore walks the array and treats each numeric index as an unknown option key.
The warnings are accurate about the schema as it stands, so they are left in place rather than silenced.
Correcting the schema is separate work and is not part of this branch.