MAINT: vendor vega assets

[johnchase]

Description

• Fixes issue MAINT: replace cdn links in vega specs.  #1 by removing jsDelivr runtime dependencies.
• Vendors Vega 5.22.1 and vega-embed 6.20.8.
• Copies both JavaScript bundles and their licenses into every generated visualization.
• Applies to scatterplot, heatmap, lineplot, and boxplot outputs.
• Adds byte-for-byte output verification and pinned SHA-256 tests.

AI Disclosure

• NO AI USED.
• AI USED.

AI Usage Details

Tool: Codex, using GPT-5.
Codex inspected the issue and contribution guidance.
Codex produced all new Python implementation, tests, and vendor documentation.
Codex downloaded the pinned upstream Vega assets, verified checksums, ran tests/linting, and pushed the commits.
User independently tested plugin, verified visualization, tested offline usage.
User defined implementation details such as package structure and naming
User independently reviewed PR

[lizgehret]

Hey @johnchase thanks for this contribution, this had been on my list for quite some time!

Initial review looks good with a few small formatting requests. I'm going to do some local testing/poking around; I'll follow up in the next couple of days if anything else is needed before getting this merged!

[lizgehret]

Hey @johnchase I'm going to go ahead and implement these suggestions to save you some time (assuming you won't mind)

[lizgehret]

Another follow-up; I did a bit more refactoring to the viz rendering that will make it easier to refactor the asset tests so we aren't hard coding the visualizations that currently exist (and rather are doing these checks against all available visualizations at any point in time). I'm going to finish this up tomorrow and then will have @misialq review!

[lizgehret]

Okay refactor is all finished and ready for your review @misialq 🙂

[misialq]

LGTM @lizgehret! 🎉 (I tested using the boxplot visualization)

[lizgehret]

Note for posterity (moving from the vendor README):

As of these PR changes, the size of each .qzv generated will now increase in size by 194.6 KB (when compressed).
This number may change in the future if/when the version of vega being used gets bumped.