`addReference()` does not validate `xpath`, so a reference without one fails with `XPath parse error`

[cjbarth]

Summary

Reference.xpath is declared optional (src/types.ts:126), and addReference() takes Partial<Reference> & Pick<Reference, "xpath">, which keeps it optional. So a reference with no xpath type-checks, is accepted, and fails later inside the xpath library:

const sig = new SignedXml({ privateKey, canonicalizationAlgorithm, signatureAlgorithm });
sig.addReference({ transforms: [canonicalizationAlgorithm], digestAlgorithm });
sig.computeSignature("<root>trusted</root>");
// XPath parse error

computeSignature() evaluates ref.xpath ?? "" (src/signed-xml.ts:971 and :1121), and the empty expression is what raises XPath parse error. Identical on master and 6.1.2.

addReference() already rejects its other missing required inputs by name — digestAlgorithm is required (:825) and transforms must contain at least one transform algorithm (:829). The xpath equivalent is missing, so the one input with no validation is the one that decides which elements get signed.

Suggested fix

1. Throw xpath is required in addReference(), matching the existing two messages.
2. Make xpath required in Reference (or in the addReference() parameter type) so the compiler rejects it too.
3. Drop both ref.xpath ?? "" fallbacks, which then cannot be reached.

Step 1 rejects input that is currently accepted and step 2 changes a public type, hence v7.0.

Context

Found while tracing the codecov/patch gap on #577: the two ?? "" fallbacks are partial branches in that PR's diff. They are only reachable through this hole, so validating the input removes the untestable code rather than adding a test for it.