Move UI dependencies to suggest, default to the https endpoint, and add CI

@tbcs, thanks for splitting this out. With #3618910: Expose Surface for use with OpenStreetmap Module et al. merged I rebased the branch onto 1.0.x (no conflicts; your two commits keep your authorship) and pushed three commits on top. The packaging part is what I hoped for: geocoder, leaflet and the Nominatim provider move to suggest, overpass_api_ui.info.yml still refuses to enable without them, and overpass_api_update_10002() only touches sites still on the exact old default.

"Trim the docs and composer.json to what 1.0.x ships": the branch was written on top of the preset and Feeds work, so a few things described code that is not on 1.0.x, or changed after you wrote them:

• README: dropped the Presets section and the Overpass API Feeds bullet; they come back with #3614000: Add overpass_api_preset submodule: Provide a Config Entity to save, reuse, and export Overpass queries and #3614002: Add overpass_api_feeds submodule: Allow creating Feeds sources directly from Query Builder (overpass_api_ui) to import OSM data.
• overpass_api_ui README: dropped the Presets block. Its {{bbox}} note was the opposite of what 1.0.x does: QueryBuilderForm::assembleRawQuery() still substitutes (%F,%F,%F,%F) with the parentheses. The note fits once the preset work lands.
• composer.json: dropped drupal/feeds from require-dev and suggest, for the same reason.
• README, Configuration: the settings form has no fields for the User-Agent or the batch size yet, so it now says they are configuration only (user_agent, chunk_size).
• README, Errors: updated to the contract after the last #3618910: Expose Surface for use with OpenStreetmap Module et al. commit: only 408, 429, 500 and 504 are retried, and a failure without any response arrives as OverpassApiException itself.
• .gitlab-ci.yml: dropped the comment above _CSPELL_WORDS, which described nothing below it.

"Fix the cspell and phpcs findings" and "Fix the phpcs errors coder 8.3 reports": since this issue introduces the CI config, I cleaned up what it reports (the second commit because the pipeline runs coder 8.3.31 and I had first checked with 9.0.1; the two disagree on a few lines):

• cspell: the module's domain words in _CSPELL_WORDS, a cspell:ignore for "İzmir" in QueryBuilderTest, the betweeen typo, "synchronized", and "Please" (forbidden by Drupal's dictionary) out of the flood message and a test remark. The cspell job is green now.
• phpcs: all errors fixed (permissions file newline, use Url in overpass_api_ui.install, the lock message indentation in SettingsForm, fall-through comments in Utils::returnBytes(), two nested arrays in QueryBuilderTest). Checked with coder 8.3.31, which the pipeline uses, and with 9.0.1. The job stays red only on the 23 DrupalPractice "\Drupal calls should be avoided" warnings in the two forms, which go away with the dependency injection in #3630442: Inject services into SettingsForm and QueryBuilderForm, and lower the retry defaults.

eslint (query-builder-map.js) and phpstan (mostly \Drupal calls in the two forms) are bigger and overlap with #3630442: Inject services into SettingsForm and QueryBuilderForm, and lower the retry defaults, so they stay allow_failure for now.

On the ^10.3 floor: I could not find anything on 1.0.x that needs 10.3, so I read it as a support-policy change. That's fine with me, since 10.3 is out of security support; it goes into the 1.0.0-beta5 release notes.

Please have a look at the three commits. I'd like this to land before 1.0.0-beta5, so the https default goes out with the #3618910: Expose Surface for use with OpenStreetmap Module et al. changes in one set of release notes. If nothing comes up, I'll merge it in a few days.

@tbcs, I've just updated the MR !10's title and description too. Since my last comment, three more commits make every pipeline job green, eslint, phpcs and phpstan included:

• Both forms now get their services injected instead of calling \Drupal. That was planned for #3630442: Inject services into SettingsForm and QueryBuilderForm, and lower the retry defaults, which now keeps only the retry defaults.
• While there, "Check API status" now catches OverpassApiException; since #3618910: Expose Surface for use with OpenStreetmap Module et al. a failed status request ended in an error page.
• The last phpstan findings, and the eslint ones in query-builder-map.js.

Squash is off, so your two commits stay as they are in 1.0.x. If nothing comes up, I'll merge in a few days.