Reject installing package managers without provenance that had provenance previously

### Description

Reject installing package managers that had provenance previously. It is similar to [pnpm's `trustPolicy: no-downgrade`](https://pnpm.io/settings#trustpolicy), but for the package managers installed by viteplus internally.

This makes it difficult to attack the package managers.

### Suggested solution

Add the provenance check here: https://github.com/voidzero-dev/vite-plus/blob/491cd3f488fe057b4627a4ea850f6c5c56d50883/crates/vite_install/src/request.rs#L236

- [npm](https://www.npmjs.com/package/npm?activeTab=versions): does not have provenance
- [yarn](https://www.npmjs.com/package/@yarnpkg/cli-dist?activeTab=versions): has provenance for `>=4.9.3`
- [pnpm](https://www.npmjs.com/package/pnpm?activeTab=versions): has provenance for `>= 10.20.0`
- [bun](https://github.com/oven-sh/bun/releases): does not have provenance

### Alternative

_No response_

### Additional context

_No response_

### Validations

- [x] Read the [Contributing Guidelines](https://github.com/voidzero-dev/vite-plus/blob/main/CONTRIBUTING.md).
- [x] Confirm this request is for Vite+ itself and not for Vite, Vitest, tsdown, Rolldown, or Oxc.
- [x] Check that there isn't already an issue requesting the same feature.

Lisez crates/vite_install/src/request.rs autour de la ligne 236 pour comprendre l’installation existante des gestionnaires de paquets et la gestion de la provenance. Vérifiez les détails de provenance indiqués pour npm, yarn, pnpm et bun par rapport au comportement demandé sans rétrogradation. C’est terminé lorsqu’un gestionnaire de paquets installé en interne est rejeté s’il n’a pas de provenance après une version précédemment associée à une provenance.

Rédigé par le modèle d'indexation à partir du texte de l'issue.