Add opt-in bonus-roll confirmation

[andybergon]

What does this PR do?

Adds opt-in QoL > Bonus Roll Confirmation to help avoid spending a bonus roll accidentally. The Roll prompt shows the current loot specialization. The cog's Only Confirm Roll defaults on, leaving Pass immediate; turning it off also asks before passing.

Confirmation uses EllesmereUI's popup and addon-owned buttons over the native Roll/Pass controls. Native click handlers remain unchanged. Pending approvals are invalidated when the roll, loot specialization, or settings change. The feature defers to BonusRollConfirm when that addon is loaded.

Draft while the revised click interception and combat behaviour receive in-game testing.

How was it tested?

• 20 Lua 5.1 regression tests pass: default-off behaviour, Roll/Pass modes, cancellation, repeated approval, expired/replaced rolls, specialization changes, delayed frame creation, settings/reset, addon coexistence, unchanged native handlers, unrelated addon loads, overlay visibility and hover forwarding.
• Changed Lua files compile under Lua 5.1. Merged current upstream and regenerated locale keys.
• Both dialogs were captured in game with the earlier handler-based implementation. Their appearance is unchanged; the revised overlay implementation has not yet been tested in game. Actual Roll/Pass outcomes and combat/taint checks remain pending.
• Known draft limitation: the overlay may suppress the native button's hover/pressed artwork. Tooltip handlers are forwarded; visual feedback still needs verification and adjustment.

Screenshots

Before enabling this option, the native buttons act immediately without these dialogs. Both images below show the opt-in confirmation UI, rather than a before/after comparison.

Roll confirmation with loot specialization:

Pass confirmation when Only Confirm Roll is off:

Checklist

• New settings default OFF: the feature is off; its subordinate roll-only option defaults on.
• Zero runtime setup while never enabled: no feature events, hooks, or frames. Disabling unregisters events and hides overlays; installed lifecycle post-hooks remain inactive.
• Cheap while enabled: event-driven, no polling or added timers; native remaining time is checked when approving.
• No writes onto Blizzard-owned frames: scripts are set only on addon-owned overlays; native lifecycle uses post-hooks.
• Revised implementation tested in-game: dialog appearance is evidenced above, but native action and combat checks remain pending. No version gates or pre-Midnight API branches added.