Exempt inert schema-typed Liquid settings from LIQUID_UNSAFE_RENDER

[jplhomer]

WHY are these changes introduced?

LIQUID_UNSAFE_RENDER flagged every block.settings.* / section.settings.* output the same way, including select/checkbox settings whose values are fixed by the extension schema (e.g. a layout select with left|right options, or a boolean toggle used as a class). Those closed, developer-defined value domains cannot carry merchant-injected markup in HTML text or ordinary attribute contexts.

WHAT is this pull request doing?

• liquid-rules.ts: extract the {% schema %} JSON from the same file, map setting id -> type, and thread it into liquidUnsafeRenderVisitor. Exempts only exact block.settings.<id> / section.settings.<id> (no property access) in html_text / non-URL html_attribute contexts for checkbox, range, and select/radio where every options[].value passes a conservative inert charset (no <, >, &, quotes, backtick, whitespace, or =). Missing, unparseable, or duplicated schema, unsafe option values, and all other types fall through to previous behaviour (fail-closed).
• Untouched: liquidExecutableContextVisitor (UNSAFE_INNERHTML), JavaScript/executable contexts, URL attributes, metafields.
• Bumps LIQUID_UNSAFE_RENDER v1 -> v2 in scanners/index.ts and checks/LIQUID_UNSAFE_RENDER.md, regenerates checks/embedded.ts, adds the missing version-pin assertion, and adds the targeted test matrix (inert select clean in text/attribute, bad option flagged, checkbox/range clean, text/richtext flagged, script/onclick flagged, missing/unparseable schema flagged, escaped stays clean).

Follow-up (out of scope): update the shopify.dev app-security check page for LIQUID_UNSAFE_RENDER in shop/world to describe the typed exemption.

How to manually test your changes?

In a theme app extension block, add a {% schema %} with a select setting (inert options), a checkbox, and a text setting; render each unescaped in element text and in a class attribute, then run the app-security scan. The select/checkbox outputs should no longer raise LIQUID_UNSAFE_RENDER, while the text output still should.

[jplhomer]

/snapit