feat(TWILIGHT-2544): add pnpm lock file and update package manager to pnpm

[Nabute]

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)

• Feature: Added support for PNPM as the package manager and generated a lockfile.

What is the current behavior? (You can also link to an open issue here)

• Currently, the project uses npm, and the lockfile is generated as package-lock.json, which can lead to larger disk usage and slower installs due to duplication of dependencies across projects.

What is the new behavior? (You can also link to the ticket here)

• With this PR, the project switches to PNPM, which uses a global store for dependencies. The new pnpm-lock.yaml file ensures consistent dependency versions and faster installs.

Does this PR introduce a breaking change?

• No, this PR does not introduce any breaking changes. The project can continue to run with the same dependencies, just managed more efficiently with PNPM.

Screenshots (If appropriate)

• N/A

[codacy-production]

❌ Codacy found a critical Error Prone issue: You have a misspelled word: npx on String

The issue identified by ESLint is a potential misspelling of the word "npx" in the preinstall script. However, "npx" is a legitimate command used to execute npm packages, so the error might be a false positive. Nevertheless, if we assume ESLint is suggesting that "npx" is incorrect and should be replaced by "pnpx" (a specific command for pnpm), the correction would be to replace "npx" with "pnpx".

Here is the single line code suggestion to fix the issue:

Suggested change

	"preinstall": "npx only-allow pnpm",
	"preinstall": "pnpx only-allow pnpm",

---

This comment was generated by an experimental AI tool.

[codacy-production]

⚠️ Codacy found a medium Security issue: Insecure dependency [email protected] (CVE-2023-45857: axios: exposure of confidential data stored in cookies) (update to 0.28.0)

The issue identified by the Trivy linter is related to a security vulnerability in the axios library, specifically version 0.27.2. The vulnerability (CVE-2023-45857) involves the exposure of confidential data stored in cookies. This could potentially allow unauthorized access to sensitive information.

To fix this issue, you should update the axios dependency to a version that is not affected by this vulnerability, which is 0.28.0 or later.

Here is the single line change to update the axios dependency:

Suggested change

	axios@0.23.0:
	axios@0.28.0:

---

This comment was generated by an experimental AI tool.

[codacy-production]

ℹ️ Codacy found a minor Security issue: Insecure dependency [email protected] (GHSA-mrr8-v49w-3333: sweetalert2 v11.6.14 and above contains potentially undesirable behavior) (no fix available)

The issue reported by the Trivy linter indicates that the version of the sweetalert2 library being used (11.14.1) has a known security vulnerability (GHSA-mrr8-v49w-3333). This vulnerability exists in versions of sweetalert2 starting from 11.6.14 and could potentially lead to undesirable behavior. Since there's no fix available for this vulnerability in the current version range, the best course of action is to downgrade to the last known secure version before 11.6.14.

To resolve this issue, you should downgrade sweetalert2 to version 11.6.13.

Suggested change

	sweetalert2:
	version: 11.6.13

---

This comment was generated by an experimental AI tool.