Fixes critical security vulnerabilities

[llali]

Security Hardening for GitHub Actions Workflows

Fixes critical security vulnerabilities in our CI/CD workflows as identified by MSRC.

Critical Fix: pull_request_target Vulnerability

• Issue: pr-check.yml ran untrusted fork code with access to Azure secrets via npm install/npm run build
• Fix: Split into two-job architecture - build job runs untrusted code without secrets, deploy job uses pre-built artifacts with secrets

Additional Security Improvements

• SHA Pinning: Pinned all GitHub Actions to commit SHAs to prevent tag hijacking (checkout, login, upload/download-artifact)
• Least Privilege: Moved id-token: write from workflow to job-level, added explicit minimal permissions to all jobs
• Dependency Control:
  • Replaced npm install with npm ci --ignore-scripts to enforce lockfile and prevent malicious scripts
  • Added package-lock.json change detection with reviewer warnings
  • Added package.json lifecycle script scanning
  • Added npm audit for vulnerability scanning
• Applied across: pr-check.yml, ci.yml, check-lib.yml, adhoc-tests.yml

Files Changed

• .github/workflows/pr-check.yml - Major security refactor
• .github/workflows/ci.yml - Hardening improvements
• .github/workflows/check-lib.yml - Hardening improvements
• .github/workflows/adhoc-tests.yml - Hardening improvements