feat: add Bun and npm lockfile scrub action

[peakematt]

Socket Firewall registry URLs saved in lockfiles can bind later installs to an endpoint that contributors or external CI cannot access. Bun can record these URLs directly; npm has omit-lockfile-registry-resolved=true to prevent them, but a reusable cleanup backstop is useful when that configuration is absent.

This adds workos/setup-socket-firewall/lockfile-scrub with format-specific behavior: Bun bun.lock URLs become Bun's native empty resolved-URL field, while npm package-lock.json and npm-shrinkwrap.json versions 1–3 retain their tarball URLs with the canonical registry.npmjs.org host. The npm transform changes only resolved string values and preserves formatting, paths, query strings, fragments, versions, and integrity hashes.

The action handles one workspace-relative lockfile path per invocation, including nested paths, and defaults to bun.lock. check reports changed without modifying the file; apply performs the repair. Missing or unsupported files, traversal, symlinked paths, and malformed npm JSON fail without changing the original. The action installs nothing, receives no token, and never commits. Caller workflows own any same-repository GITHUB_TOKEN commit; those commits do not trigger another Actions run, so file validation must not be mistaken for fresh-head application CI.

The npm helper is included in the allowlisted action-only release. No consumer rollout is enabled by this PR: the four Bun repositories in HELP-723 still need separate workflows pinned to the signed release SHA after merge. Yarn and pnpm scrubbing are not included.

From the repository root, with Bash and Node.js 22+ (no dependency installation needed):

bash scripts/scrub-lockfile.test.sh
node --test scripts/scrub-npm-lockfile.test.mjs
bash scripts/build-release.test.sh

These checks passed locally and cover transformations, unchanged check-mode bytes, idempotence, path rejection, and execution from the packaged release tree. Local npm ci --ignore-scripts probes also passed for both npm filenames across versions 1–3, with each lockfile unchanged after installation. The existing configure, teardown, and release-publisher tests, ShellCheck, and pinned shfmt checks passed as well.

CI adds the same six npm install combinations using the actual composite action, plus a scrubbed-lockfile install in the existing token-backed job with public registry DNS blocked. That protected behavior requires the CI run; it is not established by the local public-registry probes.

Tracking: https://linear.app/workos/issue/HELP-723