Reject installing package managers without provenance that had provenance previously

### Description

Reject installing package managers that had provenance previously. It is similar to [pnpm's `trustPolicy: no-downgrade`](https://pnpm.io/settings#trustpolicy), but for the package managers installed by viteplus internally.

This makes it difficult to attack the package managers.

### Suggested solution

Add the provenance check here: https://github.com/voidzero-dev/vite-plus/blob/491cd3f488fe057b4627a4ea850f6c5c56d50883/crates/vite_install/src/request.rs#L236

- [npm](https://www.npmjs.com/package/npm?activeTab=versions): does not have provenance
- [yarn](https://www.npmjs.com/package/@yarnpkg/cli-dist?activeTab=versions): has provenance for `>=4.9.3`
- [pnpm](https://www.npmjs.com/package/pnpm?activeTab=versions): has provenance for `>= 10.20.0`
- [bun](https://github.com/oven-sh/bun/releases): does not have provenance

### Alternative

_No response_

### Additional context

_No response_

### Validations

- [x] Read the [Contributing Guidelines](https://github.com/voidzero-dev/vite-plus/blob/main/CONTRIBUTING.md).
- [x] Confirm this request is for Vite+ itself and not for Vite, Vitest, tsdown, Rolldown, or Oxc.
- [x] Check that there isn't already an issue requesting the same feature.

Lee crates/vite_install/src/request.rs alrededor de la línea 236 para entender la instalación existente de gestores de paquetes y el manejo de la procedencia. Comprueba los detalles de procedencia indicados de npm, yarn, pnpm y bun con respecto al comportamiento solicitado de no degradación. Se considera terminado cuando se rechaza un gestor de paquetes instalado internamente si carece de procedencia después de una versión respaldada previamente por procedencia.

Escrito por el modelo de indexación a partir del texto del issue.