Add pnpm audit workflow

[niStee]

• Add pnpm audit workflow on PRs to main/stable and weekly (Wed 04:15 UTC).
• Use Node 20 and pnpm 10.9.0 (pnpm cache) with pnpm install --frozen-lockfile.
• Run two audits: full pnpm audit --prod (captured to summary) and enforcing pnpm audit --prod --audit-level=high (fails on high/critical). Summary always shows all severities.
• Minimal permissions (contents: read). Actions tag-pinned; Renovate will handle digest pinning Add conservative Renovate configuration with gated majors #5116.

---

Testing/impact: Workflow-only change; no runtime code touched.

[a5ehren]

the pnpm action will pull the version from package.json, you shouldn't have to specify it

[a5ehren]

current version of electron uses node 22, should audit against that

[arielj]

I don't think pnpm audit is that useful in our case, at least not as something that should block merging PRs

like... if I'm working on something and some version of a new tool is released fixing some new known vulnerability, I don't want to have to update it in my totally unrelated PR just because pnpm audit says its critical, it's not related to my PR

[niStee]

@arielj fair point!
You shouldn't be blocked on unrelated pull requests.
I've updated this PR so that it's just for information. Even if a high-priority or critical issue is found, it won't prevent merging (unless we make it a required check in the repository settings, which we shouldn't do).
It's just a 'heads up' for the team.