Sanitize package.json and prevent command injection in ABP CLI

[maliming]

• Add --ignore-scripts flag to all npm/yarn install and add commands to prevent execution of potentially malicious lifecycle scripts from package.json.
• Validate npm package names against a strict regex (@scope/package-name pattern) before passing them to shell commands, preventing OS command injection via crafted dependency names (e.g. @abp/core && calc.exe).
• Add unit tests for package name validation covering both valid names and various injection patterns.

Fixes #25209

[Copilot]

Pull request overview

This PR hardens ABP CLI’s Node package operations by adding --ignore-scripts to npm/yarn install/add commands, reducing the risk of executing malicious lifecycle scripts from package.json (fixes #25209).

Changes:

• Add --ignore-scripts to npm install and yarn execution in NpmHelper.
• Add --ignore-scripts to npx yarn add calls used when modifying projects.
• Add --ignore-scripts to install flows in NpmPackagesUpdater.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
framework/src/Volo.Abp.Cli.Core/Volo/Abp/Cli/Utils/NpmHelper.cs	Adds --ignore-scripts to npm/yarn helper commands.
framework/src/Volo.Abp.Cli.Core/Volo/Abp/Cli/ProjectModification/ProjectNpmPackageAdder.cs	Adds --ignore-scripts to yarn add when adding packages to projects.
framework/src/Volo.Abp.Cli.Core/Volo/Abp/Cli/ProjectModification/NpmPackagesUpdater.cs	Adds --ignore-scripts to yarn/npm installs during update workflows.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

framework/src/Volo.Abp.Cli.Core/Volo/Abp/Cli/ProjectModification/ProjectNpmPackageAdder.cs:82

• versionPostfix uses version != null, so an empty/whitespace version (which currently passes EnsureSafeVersion) becomes "@"/"@ ", producing an invalid yarn add command. Normalize version (trim + null if empty) or build the postfix with !string.IsNullOrWhiteSpace(version) so optional/empty versions behave correctly.

        if (!File.ReadAllText(packageJsonFilePath).Contains($"\"{npmPackage.Name}\""))
        {
            var versionPostfix = version != null ? $"@{version}" : string.Empty;