Reject installing package managers without provenance that had provenance previously

### Description

Reject installing package managers that had provenance previously. It is similar to [pnpm's `trustPolicy: no-downgrade`](https://pnpm.io/settings#trustpolicy), but for the package managers installed by viteplus internally.

This makes it difficult to attack the package managers.

### Suggested solution

Add the provenance check here: https://github.com/voidzero-dev/vite-plus/blob/491cd3f488fe057b4627a4ea850f6c5c56d50883/crates/vite_install/src/request.rs#L236

- [npm](https://www.npmjs.com/package/npm?activeTab=versions): does not have provenance
- [yarn](https://www.npmjs.com/package/@yarnpkg/cli-dist?activeTab=versions): has provenance for `>=4.9.3`
- [pnpm](https://www.npmjs.com/package/pnpm?activeTab=versions): has provenance for `>= 10.20.0`
- [bun](https://github.com/oven-sh/bun/releases): does not have provenance

### Alternative

_No response_

### Additional context

_No response_

### Validations

- [x] Read the [Contributing Guidelines](https://github.com/voidzero-dev/vite-plus/blob/main/CONTRIBUTING.md).
- [x] Confirm this request is for Vite+ itself and not for Vite, Vitest, tsdown, Rolldown, or Oxc.
- [x] Check that there isn't already an issue requesting the same feature.

Read crates/vite_install/src/request.rs around line 236 to understand the existing package-manager installation and provenance handling. Check the listed npm, yarn, pnpm, and bun provenance details against the requested no-downgrade behavior. Done means an internally installed package manager is rejected when it lacks provenance after a previously provenance-backed version.

Written by the indexing model from the issue text.