fix(security): run npm ci with --ignore-scripts

[jcchavezs]

This would avoid malicious scripts in vulnerable packages to be executed on CI

[jonathanp-okta]

@jcchavezs, thanks for the contribution. This is a useful defense-in-depth improvement: --ignore-scripts prevents dependency lifecycle scripts from executing during npm ci.

I tested the project with a clean npm ci --ignore-scripts installation, and all Vitest and Playwright tests passed. Please rebase this branch onto the latest master to resolve the current workflow conflicts. Once it is rebased and CI passes, this should be good to review.

For clarity, this mitigates install-time script execution but does not prevent malicious dependency code from running when explicitly loaded by tests, builds, or CLI commands.