graphql_compose_codegen 1.6.0

### Changed

- `TypeScriptGenerator::buildArtefacts()` computes `typeEntries()` once per
spec and reuses that map for types, fragments, renderer cases, and stubs.
- `hook_help` links the settings form via
`Url::fromRoute('graphql_compose_codegen.settings_form')`.
- `PathGuard::lexicalNormalise()` no longer handles `..` segments (already
rejected by `validate()`). Drop the orphan `.gitignore` `/docs/superpowers/`
entry.
- Optional Codegen MCP tools declare typed outputs and plugin permissions.
Kernel coverage now includes authorized reads, anonymous and wrong-scope
refusal, malformed and oversized selectors, disabled integration,
generator-identical artefacts, and unchanged files/snapshots.
(#3623734: Expose bounded schema inspection and generation previews through Tool API(https://www.drupal.org/project/graphql_compose_codegen/issues/3623734))