fix(security): resolve critical protobufjs CVE and scope gitleaks to PR commits

- Add protobufjs>=7.5.5 override in pnpm-workspace.yaml to fix
  GHSA-xq3m-2v4x-88gg (arbitrary code execution) pulled in via
  @xenova/transformers > onnxruntime-web > onnx-proto
- Update pnpm-lock.yaml: onnx-proto now resolves protobufjs@7.6.2
- Scope gitleaks scan to origin/<base>..HEAD so only commits
  introduced by the PR are checked, not the full repo history

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Xaxxoo

.github/workflows/security.yml

@@ -73,7 +73,9 @@ jobs:
           sudo mv gitleaks /usr/local/bin/gitleaks
 
       - name: Run Gitleaks
-        run: gitleaks detect --source=. --exit-code 1
+        run: |
+          gitleaks detect --source=. --exit-code 1 \
+            --log-opts="origin/${{ github.base_ref }}..HEAD"
 
   container-scan:
     name: Container Scan (Trivy)

pnpm-lock.yaml

@@ -7,3 +7,6 @@ allowBuilds:
   msgpackr-extract: true
   protobufjs: true
   sharp: true
+
+overrides:
+  protobufjs: '>=7.5.5'