Close deep imports under `lib/` with an `exports` map

[cjbarth]

package.json has no exports field, so every compiled module under lib/ can be deep-imported: 34 runtime exports across 10 modules, against 5 from the package root. #441 deprecates them in 5.2.0, after exporting from the root the types the root API already uses. Nothing else is promoted. This issue is the v6 step that follows.

• Add an exports map to package.json that exposes the package root and nothing under lib/.
• In the v6 release notes, say what to use instead: the package root for anything it exports, and @xmldom/xmldom, xpath and xml-crypto directly for the XML helpers that public code deep-imports today (parseDomFromString, xpath, signXml and signSamlPost, per Deprecate deep imports under lib/, and export from the root the types its API uses #441).

Closing the surface also makes "document the entire external API" a bounded job: a handful of exports plus the types, rather than 34 across 10 modules. It also settles, for every symbol at once, the question #429 had to argue for a single function: whether removing something that is reachable only by deep import is breaking.

Related

• Deprecate deep imports under lib/, and export from the root the types its API uses #441: the 5.2.0 decision and deprecation this depends on. It has to ship first, since AGENTS.md removes only what was already deprecated.
• Remove the validateSignature export #429: removes validateSignature, one of the lib/xml exports.