implicit-html-roles `input` mappings are inconsistent with html-aria

### Product

axe-core

### Product Version

4.10.2

### Latest Version

- [x] I have tested the issue with the latest version of the product

### Issue Description

[implicit-html-roles.js](https://github.com/dequelabs/axe-core/blob/develop/lib/commons/standards/implicit-html-roles.js#L143-L182) today only has a partial understanding of the [ARIA in HTML input element mappings](https://html.spec.whatwg.org/multipage/input.html#button-state-(type=button)).

As of [ARIA in HTML 20241223](https://www.w3.org/TR/2024/REC-html-aria-20241223/) and axe-core 4.10.2, the cases look like this:

| input type | ARIA in HTML role | axe-core 4.10.2 role | matches |
| - | - | - | - |
| button | button | button | ✅ |
| checkbox | checkbox | checkbox | ✅ |
| color | null | textbox (default) | ❌ |
| date | null | textbox (default) | ❌ |
| datetime-local | null | textbox (default) | ❌ |
| email (no list attr)| textbox | textbox | ✅ |
| email (with list attr) | combobox | combobox | ✅ |
| file | null | textbox (default) | ❌ |
| hidden | null | textbox (default) | ❌ |
| image | button | button | ✅ |
| month | null | textbox (default) | ❌ |
| number | spinbutton | spinbutton | ✅ |
| password | null | textbox (default) | ❌ |
| radio | radio | radio | ✅ |
| range | slider | slider | ✅ |
| reset | button | button | ✅ |
| search (no list attr) | searchbox | searchbox | ✅ |
| search (with list attr) | combobox | combobox | ✅ |
| submit | button | button | ✅ |
| tel (no list attr) | textbox | textbox | ✅ |
| tel (with list attr) | combobox | combobox | ✅ |
| text (no list attr) | textbox | textbox | ✅ |
| text (with list attr) | combobox | combobox | ✅ |
| time | null | textbox (default) | ❌ |
| url (no list attr) | textbox | textbox | ✅ |
| url (with list attr) | combobox | combobox | ✅ |
| week | null | textbox (default) | ❌ |
| _missing type_ (no list attr) | textbox | textbox | ✅ |
| _missing type_ (list attr) | combobox | combobox | ✅ |
| _invalid type_ (no list attr) | textbox | textbox | ✅ |
| _invalid type_ (list attr) | combobox | textbox (default) | ❌ |

The logic axe-core uses vs the logic the spec uses for determining when text/tel/url/email/search should be treated as comboboxes is also slightly different; the spec says that the presence of a `list` attribute is enough that it should be treated as combobox-like, but axe-core demands that it not just have a list attribute but that the list attribute be a valid `idrefs`-style reference to a `datalist` element (`html-elms.js` is inconsistent with `implicit-html-roles.js` and just looks for any list attribute)

Some of these cases (eg, `hidden` being treated as a textbox) almost certainly need correcting. For most of these (including the `list` difference), we'll want to do compatibility testing and double check that the spec'd role mappings match what UAs are actually using in practice, but should update to match the spec'd mappings if possible.

As part of fixing this we'll want to audit for rules that target input elements that might be relying on the old behavior and double check that they aren't relying on the old behavior, there will probably be a few rules that will need new test cases for stuff like `file` inputs. We'll want to be especially careful to check on cases that look for stuff with `widget` role types; that determination will change for ``

It'd also be a good idea to also audit the set of allowed role/attributes in `html-elms.js` while we're here. For example, it looks like the spec is more permissive than axe-core about which roles `type=image` is allowed to use.

#### Expectation

axe-core's implicit role calculation should match html-aria spec (or should document why in comments if there are specific UA-compat cases that require divergence)

#### Actual
Table above is not all ✅

#### How to Reproduce
n/a

#### Additional context
n/a