Reject Vite+ install script if the `@voidzero-dev/vite-plus-cli-*` package does not have provenance

### Description

Reject Vite+ install script (`https://vite.plus`, `https://vite.plus/ps1`) if the `@voidzero-dev/vite-plus-cli-*` package does not have provenance.

Also reject `vp upgrade` for the same case.

These will make attacking viteplus more difficult.

### Suggested solution

Add checks here:
- https://github.com/voidzero-dev/vite-plus/blob/b48e0a0b6219a34664fb40c7f9dcbd0a6e150cd8/packages/cli/install.sh#L927-L934
- https://github.com/voidzero-dev/vite-plus/blob/b48e0a0b6219a34664fb40c7f9dcbd0a6e150cd8/packages/cli/install.ps1#L524-L531

And for update:
- https://github.com/voidzero-dev/vite-plus/blob/b48e0a0b6219a34664fb40c7f9dcbd0a6e150cd8/crates/vite_global_cli/src/commands/upgrade/mod.rs#L126

### Alternative

_No response_

### Additional context

_No response_

### Validations

- [x] Read the [Contributing Guidelines](https://github.com/voidzero-dev/vite-plus/blob/main/CONTRIBUTING.md).
- [x] Confirm this request is for Vite+ itself and not for Vite, Vitest, tsdown, Rolldown, or Oxc.
- [x] Check that there isn't already an issue requesting the same feature.