fix(javascript): retain unbound CommonJS semantic imports

Collect unbound literal CommonJS dependencies at the semantic module-link owner, retain null binding names and source provenance, and avoid duplicate links for calls already represented by bindings or re-exports. Preserve distinct nested calls, shadowing exclusions, dynamic binding uncertainty, and existing static asset references.

Fixes #1793.

src/domain/javascript/javascriptSemanticValues.ts

@@ -664,7 +664,8 @@ const provenanceForExpression = (
     });
   }
   const required = semanticRequireOrigin(node, context.state);
-  if (required !== undefined) return semanticOriginsProvenance([required]);
+  if (required !== undefined)
+    return semanticOriginsProvenance([required.origin]);
   if (t.isIdentifier(node)) {
     const binding = resolveSemanticBindingState(context.state, node, node.name);
     return binding === undefined