feat(aria): add notRecommended standards flag for needs-review

[chutchins25]

Adds a reusable notRecommended: true standards flag for ARIA roles and attributes that surfaces as needs review.

Stacked PR — targets chut/3341-aria-deprecated-attr (#3341), whose aria-deprecated-attr pattern this mirrors and whose aria-allowed-attr rule change it builds on. GitHub will auto-retarget to develop once #3341 merges.

What & why

Per the discussion on #3341 (@WilcoFiers / Steven Lambert), axe should have a general, data-driven way to return needs review for ARIA that is valid but not recommended — rather than handling each case ad hoc.

This is additive and changes no existing behavior:

• A notRecommended: true flag can be set on any role (ariaRoles) or attribute (ariaAttrs).
• not-recommended-role (on the aria-allowed-role rule) returns needs-review when the element's resolved role is notRecommended.
• not-recommended-attr (on the aria-allowed-attr rule) returns needs-review when the element uses a notRecommended attribute.
• As with aria-deprecated-attr, a needs-review outcome yields to a sibling check's failure (e.g. an unallowed attribute still fails the rule).

Existing deprecated handling (aria-deprecated-attr, aria-deprecated-role) is untouched — deprecated and notRecommended remain distinct.

No real data yet

No role or attribute is flagged notRecommended today — this PR provides the reusable capability Steve asked for. The checks are therefore verified data-driven via axe.configure mocks (same approach as the deprecated-attr tests), not integration fixtures.

Tests

• not-recommended-attr / not-recommended-role check units — mocked flag via axe.configure, single + multiple, negative case, open Shadow DOM case.
• aria-allowed-attr / aria-allowed-role virtual-rules — mocked flag yields incomplete.
• locales/_template.json gains exactly the two new check blocks; doc/rule-descriptions.md unchanged (no new rule); full check/commons/integration/virtual-rule suites green.

Closes #5247