Add no-top-level-side-effects rule

[pannous]

Summary

Implements the no-top-level-side-effects rule proposed in #1661.

Modules with top-level side effects cannot be safely tree-shaken. Webpack calls these "pure modules" — a module is considered side-effect-free when it doesn't execute observable operations at the top level.

What is flagged

• Top-level function calls: foo(), console.log(), foo.bar()
• Top-level optional calls: foo?.()
• Top-level new expressions: new Foo()
• Top-level tagged template literals: html`…`
• Top-level IIFE: (function() {})(), (() => {})()
• Top-level await wrapping the above: await fetch(url)

What is allowed

• Variable/const/let declarations (even with initializers): const x = foo()
• Function/class declarations
• Import/export statements
• Assignment expressions: module.exports = …, x = foo()
• Directives: 'use strict'

Exceptions (entire file is skipped)

• Files with a hashbang (#!/usr/bin/env node) — treated as scripts
• Files with no exports — treated as scripts, not modules

Test plan

• Valid cases: files without exports, hashbang files, declarations, assignments, exports
• Invalid cases: function calls, new expressions, IIFEs, tagged templates, await
• package.js tests pass (rule registered, has docs, in configs)

[sindresorhus]

I couple of things:

• export default foo() and export default await foo() currently pass. Those calls still execute during module evaluation, but the rule only inspects top-level ExpressionStatements, so anything wrapped in export default slips through.
• The matcher is also very easy to bypass with wrappers like void foo(), condition && foo(), foo(), bar(), or if (condition) { foo(); }. Those are still top-level side effects, but the current implementation doesnt report them.