Test the checkout code; publish images only for releases (#5)

- src/checkout/ (PayPal order request, pricing, VAT) and src/logging/format.ts
  hold the checkout's pure code, moved out of PayPalApi, the product service
  and config without a behaviour change.
- npm test runs node:test on the TypeScript sources (type stripping), with no
  dependencies: 21 tests, 13 pin today's output, 8 describe the correct
  behaviour for the known defects of libretech/mp#67
  and are marked todo.
- CI: the tests run in the image's base (node:22.14.0-alpine) for every pull
  request, push to main and release tag. The image is built for pull requests
  and built and published only for v* tags; main no longer publishes :main
  and :sha-* images.

Refs libretech/mp#71

Co-authored-by: Michael Czechowski <mail@librete.ch>

config/logger.ts

@@ -1,16 +1,10 @@
 import { winston } from "@strapi/logger";
+import { formatLogLine } from "../src/logging/format";
 
 export default {
 	transports: [
 		new winston.transports.Console({
-			format: winston.format.combine(
-				winston.format.printf(({ timestamp, level, message, ...rest }) => {
-					let restString = JSON.stringify(rest, undefined, 2);
-					restString = restString === "{}" ? "" : restString;
-
-					return `${timestamp}Z ${level}: ${message} ${restString}`;
-				})
-			)
+			format: winston.format.combine(winston.format.printf(formatLogLine))
 		})
 	]
 };