[6.x] Keep marked and DOMPurify out of the front-end helpers bundle

[lazerg]

The front-end helpers.js bundle ships all of marked and dompurify. It only exposes $conditions and $passkeys, and neither of those paths renders Markdown or sanitizes HTML, so every visitor downloads two libraries the page can never call.

They arrive through a single import. field-conditions/Validator.js takes data_get from bootstrap/globals.js, and globals.js also imports util/markdown.js, which brings in both. Neither library declares sideEffects: false and both instantiate at module scope, so the bundler has to keep them.

This moves data_get into its own module and points Validator.js there. globals.js re-exports it, so nothing else needed touching. The built file drops from 99,546 bytes to 28,190 (30,692 to 8,411 gzipped) with the same two exports intact.

Fixes #15173