Update Chatrix security dependencies

[lancewillett]

Summary

• Updates the Chatrix frontend dependency stack to patched security floors, including Vite 6, WordPress Scripts 31, and patched transitive resolutions for the current Dependabot alert set.
• Moves the local and CI Node runtime to Node 22, which is required by the updated Vite toolchain.
• Updates the pull-request workflow to SHA-pinned actions/checkout and actions/setup-node references.
• Adds a local service-worker build shim for the Hydrogen service-worker plugin so the iframe bundle keeps working under Vite 6/Rollup 4 bundle metadata.

Validation

• yarn install --frozen-lockfile
• yarn lint
• yarn build
• php -d error_reporting='E_ALL & ~E_DEPRECATED' ./vendor/bin/phpcs
• git diff --check

yarn audit --level critical still exits nonzero with npm-audit high/moderate/low findings, but reports zero Critical findings. The patched dependency versions in this PR target the current GitHub Dependabot alerts for the repository.

Review owner

psrpinto looks like the best reviewer: he has admin access and is the dominant recent human committer. ashfame is the Orbit maintainer with admin access, but Matticspace shows he is AFK today and has more near-term AFK scheduled.