feat(rush-lib): support pnpm strictDepBuilds, allowBuilds (10.26.0+), and dangerouslyAllowAllBuilds

[Copilot]

New Feature

Adds Rush config support for three pnpm workspace settings that control dependency build script permissions. allowBuilds version floor is corrected from 11.0.0 → 10.26.0 (when it was added to pnpm-workspace.yaml).

New pnpm-config.json settings

• globalStrictDepBuilds (pnpm 10.3.0+) — fails the install with a non-zero exit code if any dependency has an unreviewed build script (not listed in globalAllowBuilds)
• globalAllowBuilds (pnpm 10.26.0+, was incorrectly documented as 11.0.0+) — map of package matchers → true/false to explicitly allow or block build scripts; replaces the now-deprecated globalNeverBuiltDependencies and globalOnlyBuiltDependencies
• globalDangerouslyAllowAllBuilds (pnpm 10.9.0+) — skips all approval requirements; runs every dependency's install scripts unconditionally ⚠️

{
  "globalStrictDepBuilds": true,
  "globalAllowBuilds": {
    "esbuild": true,
    "core-js": false,
    "nx@21.6.4 || 21.6.5": true
  }
}

All three settings are written to pnpm-workspace.yaml during installation. Using them with an older pnpm version emits a warning.

Implementation details

• IPnpmOptionsJson / PnpmOptionsConfiguration — new fields with JSDoc and version notes
• PnpmWorkspaceFile — new strictDepBuilds / dangerouslyAllowAllBuilds YAML fields; setStrictDepBuilds() / setDangerouslyAllowAllBuilds() setters
• WorkspaceInstallManager — version-gated writes with pnpm version warnings (10.3.0, 10.26.0, 10.9.0)
• pnpm-config.schema.json — schema entries for new fields; corrected globalAllowBuilds description
• rush-init/pnpm-config.json — template updated with correct versions and new settings examples
• Tests — new fixtures and cases for all three settings in PnpmOptionsConfiguration and PnpmWorkspaceFile