google-auth-library 10.x → 11.0.0 (major): blocked on Node 22

# google-auth-library 10.x → 11.0.0: blocked on Node floor

Dependabot opened `google-auth-library` **11.0.0**. Its only breaking change is raising the minimum Node to **22** — but the repo still declares `engines.node: >=20.10.0`, so merging ships a runtime dep that contradicts our support matrix.

- **Usage:** Google SSO social login only (`forge/ee/routes/sso/social/google.js`, `OAuth2Client`).
- **CI won't catch it:** all jobs run Node 24, so the build goes green while Node 20 silently breaks (no `engine-strict` → runtime failure, not a build failure).
- **No rush:** no advisory against 10.9.1; staying on 10.x is safe.

The migration is trivial (no API changes). The blocker is a policy decision: **do we drop Node 20?** It hit EOL 2026-04-30, CI already runs Node 24 only, and `jsdom` 30 (dev-only) needs Node >=22 too — so the floor is due a bump regardless.

**Decision:** raise the floor to 22 and merge, or hold on 10.x.

If raising:

- [x] Set `engines.node` to `>=22` in `package.json`.
- [x] Update install/support-matrix docs mentioning Node 20.
- [x] Confirm container base image + release pipeline use Node >=22.
- [ ] Merge this PR (and `jsdom@30`).

Start with package.json and the Google SSO entry point at forge/ee/routes/sso/social/google.js, then review the install/support-matrix documentation and the container base image and release pipeline. Verify every Node version reference and decide whether the repository should raise its floor to 22 and merge the dependency updates, or remain on google-auth-library 10.x.

Written by the indexing model from the issue text.