Forbid private static members and refactor existing usages to module scope

[iclanton]

Summary

Adds an ESLint rule that forbids private static methods and properties (in decoupled-local-node-rig's flat profile), steering code toward module-scoped functions and variables, and refactors every existing violation across the repo to satisfy it.

Motivation

A private static member is really just module-scoped state or a helper expressed as a class member. Plain module-scoped functions/consts are simpler, avoid unnecessary ClassName. qualification, and are friendlier to bundlers.

What changed

• The rig's no-restricted-syntax rule now also forbids private static methods and properties. It stays at error severity, alongside the existing export * from '...' restriction (a single rule instance can't have per-selector severities).
• Every private static violation across all rig-consuming projects was converted:
  • private static method → module-scoped function
  • private static property → module-scoped const (or let when reassigned)

Notable edge cases (behavior preserved)

• Helpers that touch private instance members or call a private constructor were kept as private instance methods, or changed to return data so an in-class caller performs the construction (e.g. JsonSchema, LockFile, RigConfig, MinimalRushConfiguration).
• Stateful singletons (e.g. EnvironmentConfiguration) moved to module-scoped state.
• Async lazy-init caches use a require-atomic-updates suppression where appropriate (matching existing repo convention).
• Moved declarations were placed to preserve API-Extractor doc association (no .api.md churn) and avoid no-use-before-define.
• Added typed @internal test seams where tests previously reached into private statics via Reflect.set / bracket access (LockFile, OperationBuildCache).

Testing

• Full rush build passes with zero errors and zero warnings.
• rush-lib test suite passes (706 tests).