Fix CSpell failures in the GitLab CI pipeline

The `cspell` job fails with `EXIT_CODE=1`, so the pipeline is red. A clean
pipeline is on the checklist for the security advisory coverage application, so
this blocks that.

Running core's cspell configuration over the module reports **51 unique unknown
words**. They are not all the same kind of problem, and two of them are real
defects rather than dictionary gaps.

**3 words come from the committed bundle.** `acit`, `itera` and `vnode` are
fragments of minified Preact inside `dist/dropup-builder.js`. Whitelisting a
minifier's output would be wrong — the bundle is a build artefact and should not
be spell-checked at all.

**2 are a genuine spelling inconsistency.** The module uses both spellings of the
same word:

* `unsavable` — `tests/src/Kernel/AvatarImageListTest.php:82`,
`tests/src/Kernel/BackButtonMigrationTest.php:153`
* `unsaveable` — `src/PropValidator.php:200`

**1 is a personal name in a test fixture.** `js/runtime/__tests__/validation.test.js:26`
uses `'ibrahim'` as a sample value. Harmless, but a neutral placeholder reads
better in a contributed module.

**2 are deliberate XSS payloads** in security test fixtures, not prose:
`msgbox` (`vbscript:msgbox(1)`) and `Njcmlwd` (a base64 string), both in
`tests/src/Kernel/ComponentPropsTest.php`.

**20 are Commonwealth spellings** used consistently throughout the module's
comments and documentation:

```
Behaviour behaviour Licence licences Normalised normalisation normalise
normalised Serialises serialise serialised capitalises colour colours defence
emphasises generalised grey recognised unrecognised
```

**23 are project jargon, proper nouns or coined terms** that are correct as
written:

```
Dropup dropup Preact Lucide ddev artboard bypassable chev fatals fatalled
iconed iconpicker isos Isos medialist nums pilcrow shieldcheck srcs unbuilt
Please Türkiye Unticked
```

(`Please`, `Unticked` and `Isos` are worth a second look before being added —
`Please` is ordinary English and its appearance in the report may point at a
configuration quirk.)

### Steps to reproduce

Push to the issue fork and read the `cspell` job, or locally against a Drupal
checkout with core's JS toolchain installed:

cd web/core
node_modules/.bin/cspell --config .cspell.json --no-progress --unique \
--words-only --exclude '**/node_modules/**' '../modules/custom/dropup/**/*'

### Proposed resolution

1. **Stop spell-checking build artefacts.** Add `dist/**` to `ignorePaths` in a
project `.cspell.json`. Removes `acit`, `itera`, `vnode` and keeps the file
from re-breaking the job on every rebuild.
2. **Fix the inconsistency.** Settle on `unsavable` (2 uses against 1) and change
`src/PropValidator.php:200`. This is a real edit, not a dictionary entry.
3. **Replace the personal name** in `validation.test.js` with a neutral sample.
4. **Suppress the payload fixtures inline** with `cspell:disable-next-line` in
`ComponentPropsTest.php`, rather than adding attack-string fragments to the
project dictionary where they would mask future typos.
5. **Add the 23 jargon terms** to the project word list.
6. **Decide what to do about the Commonwealth spellings** — see below.

### The spelling decision

Drupal's documentation standards ask for American English, and cspell's `en-US`
language setting is the mechanical expression of that. Two ways forward:

**A. Add the 20 words to the project dictionary.** One commit, no prose churn,
job goes green. But it leaves the module's documentation in a different dialect
from the rest of Drupal, and a coverage reviewer may raise it — at which point
this has to be done anyway, with more code written in the meantime.

**B. Convert the prose to American English.** `behaviour`→`behavior`,
`colour`→`color`, `licence`→`license`, `normalise`→`normalize`,
`serialise`→`serialize`, `recognised`→`recognized`, `defence`→`defense`,
`grey`→`gray`. Touches many comment lines but no logic, and is mechanically
checkable.

Recommendation: **B**. It is a comment-only change, it is cheapest now and
strictly more expensive later, and it removes a question from the coverage
review rather than deferring it. Worth confirming that no *identifier* uses a
Commonwealth spelling first — renaming a method or a CSS class is a different
kind of change from editing a comment, and would need to stay out of this issue.

### Remaining tasks

1. Maintainer picks A or B.
2. Patch, covering all six points above.
3. Confirm the job is green on the issue fork.

### User interface changes

None.

### API changes

None, provided the spelling pass is restricted to comments and does not rename
identifiers.

### Data model changes

None.