fix: #3631091 Add the HTMX copy handler to the Copy link in the social media menu template

Issue: https://www.drupal.org/i/3631091

• menu--social-media-menu.html.twig adds hx-on:click (copy the page address, add is-copied, announce "Link copied") and hx-on:keydown (Space) to a link with the copy-link class. It attaches core's core/drupal.htmx only then. Core 11.4.10 ships htmx 2.0.x, not HTMX 4.
• The nav-menu SDC gains an optional per-item link_attributes, merged into the link. nav-menu is noUi, so no Canvas component version changes.
• Why the template: core 11.4.10's AttributeXss strips hx-* from menu link content, as htmx's own security advice says to do for user content. The same change is in Vartheme BS5 Rightup (vartheme_bs5_rightup!68 (merged)).
• README: hx-on uses eval, so a site with a strict Content Security Policy needs 'unsafe-eval' in script-src.

Nothing changes visually until a Social media menu link has the copy-link class. Varbase Starter adds one in https://www.drupal.org/i/3631092.

Checked on a Varbase Starter site with a temporary Copy link item, headless at 1440 and 390: click, Enter and Space each copy the URL and stay on the page, with no console errors.

Merge order: merge this MR first and let the dev release repackage. Then merge the Varbase Starter MR for https://www.drupal.org/i/3631092, whose footer test checks this handler.

AI-Generated: Yes

Checkpoints:

• File an issue
• Addition/Change/Update/Fix
• Testing to ensure no regression
• Automated unit testing coverage
• Automated functional testing coverage
• UX/UI designer responsibilities
• Readability
• Accessibility
• Performance
• Security
• Developer Documentation
• User Guide Documentation
• Reviewed by human
• Code review by maintainers
• Full testing and approval
• Credit contributors
• Review with the product owner
• Release notes snippet
• Release