Return None from value_source_location() for attributes written without a value

[krickert]

Fixes #333.

Problem

For an attribute written without a value (e.g. <div hidden>),
Attribute::value_source_location() either returned None or returned a
zero-length span pointing at the start of the parser's current buffer, and
which of the two you got depended on where the tag fell relative to a
write() boundary. In the None case name_source_location() was absent
too. Source locations describe the input, so they should not depend on how
the caller chunked it.

Cause

AttributeOutline::value was a plain Range defaulting to 0..0, and
iter_attrs inferred value presence from base + value.start being nonzero:

NonZero::new(base + a.value.start).map(|val| (base + a.name.start, val)),

With value.start == 0 that reduces to NonZero::new(base), which is None
only when the tag happens to sit at buffer offset 0.

Fix

Carry presence explicitly: AttributeOutline::value is now Option<Range>,
set only by finish_attr_value. Attribute::name_value_start becomes
Option<(usize, Option<usize>)>, dropping the NonZero workaround. Behavior
after the fix:

• name_source_location() is always present for parsed attributes,
  including valueless ones (previously it could be None for them).
• value_source_location() is None for valueless attributes (doc comment
  updated to say so).
• Both are independent of the chunking of write() calls.

Downstream consumers of the outline keep their observable behavior:
Attribute::value() still returns "" for valueless attributes, selector
matching still treats a missing value as empty, and the <annotation-xml>
integration-point encoding check skips valueless attributes as before.

Testing

• Added attribute_source_locations_for_valueless_attributes and
  attribute_source_locations_do_not_depend_on_chunk_size (the reproduction
  from value_source_location() returns a bogus span for valueless attributes, and whether it does depends on chunk size #333); both fail on main and pass with this change.
• ./scripts/test.sh: library tests (all suites green) and C API tests pass.
  The fuzz/test_case bindgen step could not run on my machine (no libclang),
  so that stage plus clippy/rustfmt were run individually as in CI:
  cargo fmt -- --check and all four CI clippy invocations are clean.