onselectionchange does not fire for contenteditable elements

## Description

The `onselectionchange` handler does not run on a `contenteditable` element.

Browsers send contenteditable selection changes to `Document`. This document event does not bubble.

Dioxus treats `selectionchange` as a bubbling event. The interpreter adds the listener to the Dioxus root element. The root does not receive the document event.

The separate `selectionchange` events for `input` and `textarea` elements are not affected.

## Reproduction

```rust
rsx! {
div {
contenteditable: true,
onselectionchange: |_| println!("selection changed"),
"Edit this text"
}
}
```

1. Place the caret in the editable text.
2. Move the caret or select text.
3. Examine the application output.

The handler does not run.

## Expected result

Dioxus sends the document selection change to the applicable `contenteditable` handler.

## Implementation notes

- `packages/html/src/events/generated.rs` defines `onselectionchange`.
- `packages/core-types/src/bubbles.rs` classifies unknown events as bubbling.
- `packages/interpreter/src/ts/core.ts` adds bubbling listeners to the Dioxus root.
- `packages/html/src/events/selection.rs` intentionally omits document selection data.

Add an end-to-end test for caret or selection changes in a `contenteditable` element.

Related: #3580 and #5092.

Start by tracing selectionchange handling through packages/html/src/events/generated.rs, packages/core-types/src/bubbles.rs, packages/interpreter/src/ts/core.ts, and packages/html/src/events/selection.rs. Run the existing end-to-end tests and add coverage for caret or text selection changes in a contenteditable element. Done means the handler receives document selection changes while input and textarea behavior remains unaffected.

Written by the indexing model from the issue text.