Lockfile integrity and install scripts

Checks npm, pnpm, Bun and Yarn lockfiles offline, in the spirit of lockfile-lint: packages resolved over plain HTTP, from unexpected or repository-configured registries, git or local paths outside the repository, entries without (or with SHA-1-only) integrity hashes, dependencies that run install scripts without an allow-list, and lockfiles out of date with package.json. Also flags insecure registries and pip/Composer index settings.