fix ajax so that target works but does not override source

[MichaelWest22]

Description

Fix ajax() using target element as source when no source provided

When calling htmx.ajax() with only a target and no explicit source, the
target element was being used as the source for the request context. This
caused hx-target, hx-vals, hx-headers and other attributes on the target
to bleed into the request, and inputs inside the target to be collected
as form data on POST requests.

Fix: fall back to document.body as source when none is provided, and
resolve the explicit target after Object.assign so it always wins over
any hx-target read from the source element. Also guard document.body
against collecting descendant inputs on POST, since it is only ever a
fallback and should never vacuum up all inputs on the page.

Corresponding issue:
#4005

Testing

Added tests

Checklist

• I have read the contribution guidelines
• I have targeted this PR against the correct branch (master for website changes, dev for
  source changes)
• This is either a bugfix, a documentation update, or a new feature that has been explicitly
  approved via an issue
• I ran the test suite locally (npm run test) and verified that it succeeded