feat: declare the vendored modules and check the document schema

[mcanouil]

The shared Lua modules move from _extensions/elevator/_modules/ to _extensions/elevator/_vendor/, declared in a new _extensions/elevator/_dependencies.yml manifest.
Each file now names the release it came from and carries a digest that can be checked against the published copy.
The manifest declares html.lua, logging.lua, schema-check.lua and string.lua from quarto-lua-modules at 2.1.0, and schema.lua from quarto-wizard at 3.4.0.
The entry point loads the modules from their new location.

The extension now checks the document configuration against _schema.yml while the document renders.
The check runs from the shortcode handler, because the extension contributes a shortcode and no filter.
It reports what the schema does not accept and never stops a render, and a schema that cannot be read is reported while the document still builds.

The extension reads its configuration from extensions.elevator, which is the place the validator reads and the form the documentation uses, so the check covers the documented configuration.

The documentation site renders clean.
A probe document set enabled: "maybe" and an unrecognised volume key under extensions.elevator, and gave the shortcode call an out-of-range volume and an unknown attribute.
The check named all four faults and the render still completed.
Removing the vendored schema-check.lua fails the render, which confirms the module is genuinely loaded.

Two markdownlint findings in CHANGELOG.md are older than this branch and stay untouched, and the historical 1.5.0 entries still name _modules/ because they record what shipped at the time.