aria-valid-attr-value rule too strict on aria-controls / aria-owns

The following shouldn't fail this rule:

```html
Open the modal
```

This is an example from the new [ARIA required ID references exist](https://wai-wcag-act-rules.netlify.app/standards-guidelines/act/rules/in6db8/proposed/#test-cases) ACT rule that axe got wrong. It seems we put some logic around not requiring aria-controls not to fail when aria-expanded="false" is used. That came from combobox, but I think that when aria-controls (and aria-owns) isn't required axe-core should report it as needs review when the ref is missing, not as fail.

Start with the aria-valid-attr-value rule and reproduce the reported button example with aria-controls="my-modal", then compare it with the aria-expanded="false" combobox behavior described in the issue. Done means missing references for non-required aria-controls and aria-owns are reported as needs review rather than fail, while required references still fail appropriately.

Written by the indexing model from the issue text.