[CL-277] fix bitA11yGrid inside virtual scroll viewport

[willmartian]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/CL-277

📔 Objective

Make bitA11yGrid work within a virtual scroll viewport. This will allow us to use arrow-key navigation in bit-item-group (now) and bit-table (in a future PR).

📸 Screenshots

See Storybook > Item > Virtual Scrolling

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[github-actions]

Checkmarx One – Scan Summary & Details – f7af53ee-7831-4199-8324-48a86f622d6e

New Issues (3)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	CVE-2024-53382	Npm-prismjs-1.29.0	details Recommended version: 1.30.0 Description: Prism (aka PrismJS) allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), bec... Attack Vector: NETWORK Attack Complexity: HIGH ID: %2FNA%2FdiIVtApB8ywLUvqaowqUXWRQTzaYb%2FVvUM9xKWw%3D Vulnerable Package
	CVE-2025-32996	Npm-http-proxy-middleware-2.0.7	details Recommended version: 2.0.9 Description: In http-proxy-middleware v1.3.0 through v2.0.7 and v3.x through v3.0.3, "writeBody" function can be called twice because "else if" is not used. Attack Vector: NETWORK Attack Complexity: HIGH ID: vxlacsBXNEKVVA5kYFWs67X6ofqP8m%2BTBl2XB%2FhKMGg%3D Vulnerable Package
	CVE-2025-32997	Npm-http-proxy-middleware-2.0.7	details Recommended version: 2.0.9 Description: In http-proxy-middleware versions 1.3.0 through 2.0.8 and 3.x through 3.0.4, the "fixRequestBody" function proceeds even if "bodyParser" has failed. Attack Vector: NETWORK Attack Complexity: HIGH ID: a5P3%2Fa%2Bu%2Bkrk%2F7sbapLfTOBZpBVNJ%2BRyjJnIUYdcYjY%3D Vulnerable Package

Fixed Issues (1)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CVE-2024-40643	Npm-htmlparser2-3.10.1

[codecov]

Codecov Report

Attention: Patch coverage is 10.81081% with 66 lines in your changes missing coverage. Please review.

Project coverage is 36.42%. Comparing base (fcaf5e6) to head (d99d128).
Report is 115 commits behind head on main.

✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
libs/components/src/a11y/a11y-grid.directive.ts	7.01%	53 Missing ⚠️
libs/components/src/item/item.component.ts	14.28%	6 Missing ⚠️
libs/components/src/a11y/a11y-cell.directive.ts	20.00%	4 Missing ⚠️
libs/components/src/a11y/a11y-row.directive.ts	25.00%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #14842      +/-   ##
==========================================
- Coverage   36.57%   36.42%   -0.16%     
==========================================
  Files        3190     3212      +22     
  Lines       92182    93288    +1106     
  Branches    16534    16834     +300     
==========================================
+ Hits        33720    33982     +262     
- Misses      56065    56839     +774     
- Partials     2397     2467      +70     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud