fix(security)!: disable node scripts by default

[xnyo]

Disables scripts before running npm/yarn/pnpm install in the frontend action and playwright action. This improves security and protects against npm supply chain attacks that use pre-install, install or post-install scripts to inject malicious payloads.

If those scripts are required, the new node-package-manager-allow-scripts input can be used to restore the old behavior.

For repositories using pnpm, a better approach than using node-package-manager-allow-scripts is to allowlist only the specific packages that genuinely need build scripts, reducing the blast radius. The setting to use depends on the pnpm version:

pnpm ≤9 and pnpm 10 (before 10.26) — add to package.json:

{
  "pnpm": {
    "onlyBuiltDependencies": ["esbuild", "sharp"]
  }
}

pnpm 10.26+ — add to pnpm-workspace.yaml:

allowBuilds:
  esbuild: true
  sharp: true

pnpm 11+ — same as above (onlyBuiltDependencies is removed in pnpm 11, allowBuilds is the only supported option):

allowBuilds:
  esbuild: true
  sharp: true

Note: pnpm 10+ already disables lifecycle scripts by default for all dependencies, so --ignore-scripts has no additional effect for projects on pnpm 10 or later. The CI change is most impactful for npm and yarn projects.

[xnyo]

cspell doesn't have any lifecycle scripts for install, so it's safe to always skip the, regardless of the value of node-package-manager-allow-scripts