Remove unused locals and fix ASI issues flagged by CodeQL in the JavaScript

[vharseko]

Summary

Fourth note-level CodeQL batch: the JavaScript findings — js/unused-local-variable (93), js/automatic-semicolon-insertion (7), js/unneeded-defensive-code (1). 87 fixed across 42 files, 14 dismissed as false positives.

This PR deliberately also touches files that #204, #209 and #210 change (policy.js, router-authz.js, autoPurgeAuditRecon.js, postOperation-roles.js, temporalConstraints.js, defaultMapping.js, FormGenerationUtils.js, RelationshipWidget.js, UserQueryFilterEditor.js); the overlaps are neighbouring line removals and will be resolved at merge time, whichever lands second.

Rule	Count	Change
js/unused-local-variable	79	Declarations that are never read removed: bare var x, = [] / = {} / = this, side-effect-free DOM lookups, $.Deferred(), AbstractModel.extend(...), an unused require('roles/effectiveRoles'); two dead helpers (getUserById in getavailableuserstoassign.js, join in gettasksview.js); the unused allUsedClasses / usableForQueriesClasses block in AuditEventHandlersView. Where a var list was shortened, the following object/array literal was re-indented (eslint indent). The excludeMappings → excludeMapping typo in autoPurgeAuditRecon.js is the same fix as in #209.
js/automatic-semicolon-insertion	7	Missing ; added in reconResults.js, resetPassword.js, router-authz.js, policy.js ×2, autoPurgeAuditRecon.js, defaultMapping.js.
js/unneeded-defensive-code	1	policy.js: getResource() never yields null (an unconfigured resource becomes an empty entry), so the if (resource === null) … else … around the validation was dead; the body is unwrapped. Small correctness gain: an undefined resourcePath now fails with "No resource specified" like a null one instead of a TypeError.

Dismissed as false positives (14): the 13 router-authz.js "unused function" alerts (ownDataOnly, isOneOfMyWorkflows, reauthIfProtectedAttributeChange, …) — they are referenced by name from the customAuthz expressions in conf/script/access.js, which passesAccessConfig() evaluates with eval(); and policy.js addPolicy, the documented API that custom policy scripts call, again through eval() inside additionalPolicyLoader.load().

Test plan

• Every edited .js parse-checked with Node and linted with the module's eslint config
• Grunt builds of openidm-ui-common, openidm-ui-admin, openidm-ui-enduser: eslint clean, QUnit green, BUILD SUCCESS
• mvn -pl openidm-zip -am package — ScriptRunnerTest green over all JS test modules (incl. policyFilterTest, effectiveRolesTest, temporalConstraintsTest, conditionalRolesTest)
• CodeQL on this PR closes #761–#767, #788–#854, #860, #864, #867, #868, #872–#879, #908, #922, #923