Add automated tests #26

Context

The plugin has no automated tests:

• no tests/ directory, no phpunit.xml, no JS test files;
• composer.json declares a phpunit script, but PHPUnit is not a dependency and has no configuration, so the script cannot run;
• package.json has no JS test script;
• CI (quality-php.yml, quality-js.yml) only runs composer validate, phpcs and eslint.

Recent security fixes (1.2.1 stored XSS, #24 / #25 allow policy) were only checked by hand, with local throwaway scripts.

Expected

• PHP: PHPUnit tests for BlockRenderer, run against WordPress (the repo already ships a wp-env config):
  • attribute name validation (allowlist, aria-* / data-*, rejection of names with spaces, quotes or =);
  • value escaping;
  • URL protocol check and empty output when url or title is missing;
  • allow filtering, depending on the outcome of Security: iframe allow attribute lets contributors delegate sensitive browser permissions #24.
• JS: unit tests for src/blockparty-iframe/utils.js with wp-scripts test-unit-js (parseIframeCode(), isSafeIframeUrl(), isAllowedIframeAttribute()), unless the editor moves to ServerSideRender as suggested in Security: iframe allow attribute lets contributors delegate sensitive browser permissions #24.
• CI: run both suites on pull requests.
• Fix or remove the current phpunit Composer script.