Data.SirenJSON declares an explicit export list

## Summary

`Data.SirenJSON` names what it exports, instead of exporting every top-level
binding by default.

## Motivation

The module head is bare:

```haskell
module Data.SirenJSON where
```

Every top-level binding is therefore public, and the module has no way to hold
a private helper. That turns ordinary refactoring into API design: extracting a
shared function from two instances widens the published surface as a side
effect, with nothing in review to flag it.

This surfaced concretely while surveying the encoders during #160. The
`ToJSON` instances repeat `if null xs then Nothing else Just $ "k" .= xs` eight
times; the extraction is small, behaviour-preserving, and was held back only
because it would have published a helper nobody asked for. #162 tracks it.

#69 commits this library to an API at 1.0.0.0. Whatever the module happens to
export on the day of that cut becomes the thing covered by the commitment, so
the surface is better chosen than inherited.

collection-json.hs reaches the same end through hlint's
`Use explicit module export list` warning (alunduil/collection-json.hs#170);
this issue is the siren-json counterpart, and enabling that hint here is worth
deciding alongside it.

## Scope

- Add an export list to `Data.SirenJSON` enumerating the current public
surface: the types and their constructors, the record selectors, and the
`FromEntity`/`ToEntity` classes.
- Diff the new list against what the module exports today and confirm they
match. Anything deliberately dropped is a breaking change and belongs in its
own issue, not this one.
- Decide whether to enable hlint's `Use explicit module export list` warning in
`.hlint.yaml`, which would hold the line for `src/External/` too.

## Acceptance criteria

- [ ] `Data.SirenJSON` has an explicit export list.
- [ ] The exported set is identical to today's — verified, not assumed, so this
lands as a non-breaking change.
- [ ] `cabal build` and the test suite pass unchanged.
- [ ] The hlint hint is either enabled or the decision to skip it is recorded
here.

## Additional context

Prerequisite for the refactoring in #162. Related: #133, which restructures
`SubEntity` and is a genuine breaking change, unlike this one.