chore: bring 24.6 dependencies and CI up to date - #25815

The branch has had no build maintenance since January, and its
validation workflow both ran pull request code with the base branch
workflow and refused to build anything a bot or an outside contributor
pushed, so the license-checker update opened against it never reported a
result.

CI:
- The workflow triggers on `pull_request` instead of
  `pull_request_target`, so pull request code no longer runs with the
  base branch definition and its secrets.
- Removed the `check-user-permission` gate and the step that failed the
  build for anyone without write access.
- The `Check secrets` step only runs for a pull request from this
  repository, because a fork cannot read `TB_LICENSE`, and it reads the
  secret through the step environment instead of inlining it.
- Pinned every action by commit and moved them to their current
  releases, dropped the explicit Maven setup so the runner's own Maven
  is used, and raised the CI Node to 22.23.2 and pnpm to 8.15.9.
- Narrowed the push trigger to this branch and dropped the `edited`
  pull request type, which re-ran the whole build on a title change.

Dependencies, each staying inside the line this branch supports:
- Libraries: Jackson 2.22.2, Jetty 12.0.39, Spring Boot 3.4.13,
  Hibernate Validator 8.0.5, jsoup 1.23.2, Javassist 3.33.0, slf4j
  2.0.19, JAXB 4.0.9, Guava 33.7.1, commons-io 2.22.0, commons-lang3
  3.20.0, Mockito 5.23.0 with the Byte Buddy 1.17.7 it expects, ASM
  9.10.1, Roaster 2.31.1, Nimbus JOSE+JWT 9.48 and the Eclipse runtime
  bundles.
- Build plugins: Surefire and Failsafe 3.6.0, Clean 3.5.0, WAR 3.5.1,
  Build Helper 3.6.2 and Properties 1.3.1.
- TestBench 9.5.8 with license-checker 2.3.3. The pair belongs together:
  TestBench 9.3 needs the license-checker 1.x API, so moving the checker
  alone would break every integration test. `com.vaadin:open` moves to
  8.5.0.5 with it, which is what the new checker brings and what the
  convergence rule requires.
- Default Node is v22.23.2 and npm 10.9.8. The default pnpm stays
  8.6.11 on purpose: the newer pnpm hoists differently, which makes the
  dev bundle build fail to resolve `react-router`, and the fix for that
  is the hoisted node-linker work that landed on 24.7.

Build and test fixes the updates made necessary:
- `jcip-annotations` is declared for tests, because TestBench 9.5 no
  longer brings it transitively and the tests use `@NotThreadSafe`.
- The license checker mock in `BuildFrontendUtilTest` no longer stubs
  the logger accessor, which is not public in license-checker 2.x, and
  returns mocks for the statics it does not stub.
- `ElementTest` expects the pretty printing of jsoup 1.23, which keeps a
  single inline child on the same line as its parent.
- `flow-webpush` clears the inherited `testListener` property. The root
  POM registers a JUnit 4 listener for every module and Surefire 3.6.0
  resolves that class before running any test, so the module failed with
  `ClassNotFoundException`; 3.5.2 ignored it. The module has no tests.
- `slf4j-simple` comes from `${slf4j.version}` in the two express build
  test modules instead of a literal 2.0.16.
- The Spring integration tests resolve components from platform 24.6.13
  instead of 24.6.7.
- `DevToolsWrapper` builds its CDP commands by hand instead of using
  Selenium's generated `vNNN` classes, which only work with the Chrome
  versions a Selenium release happens to bundle.

Tooling:
- Added `scripts/update-frontend-dependencies.sh` so the branch can join
  the weekly frontend update job. The frontend package versions are left
  to that job.
- Added `.pnpm-store/` to `.gitignore`.

Three things the updates in this branch left behind:

The integration tests called `Timeouts.setScriptTimeout(long, TimeUnit)`,
which the Selenium that TestBench 9.5 brings no longer has, so every
module carrying such a test failed to compile and took its whole shard
with it. They now pass a `Duration`, like the later branches do.

The Spring integration tests asked for components 24.6.13. Platform
patch releases do not always republish the component artifacts, and that
version exists for none of them, so dependency resolution failed. 24.6.12
is the newest that does exist.

`JarContentsManagerTest` compared the copied file against the wall clock,
which only held when no clock tick fell between the copy and the check.
It now compares the file against its own timestamp.