fix(pinning): pin CAP bookshop dev deps after Mini Shai Hulud incident

[mathias-vandaele]

This pull request focuses on supply-chain security hardening for the odata-connector/cap-bookshop test backend, in response to the SAP "Mini Shai-Hulud" npm incident. The main changes include pinning dependencies to specific versions, updating installation practices to prevent execution of potentially unsafe scripts, and documenting the security context and mitigations.

Dependency and supply-chain security hardening:

• Pinned @sap/cds to version 8.1.1 and @cap-js/sqlite to version 1.7.6 in both package.json and package-lock.json to avoid vulnerable or unexpected package updates. [1] [2]
• Updated the Dockerfile to use npm ci --ignore-scripts for reproducible installs and to prevent execution of package lifecycle scripts, reducing the risk from compromised dependencies.

Documentation and transparency:

• Added a detailed "Security scope" section to readme.md, explaining the test-only usage, supply-chain review, and specific mitigations taken against the npm incident.

[CLAassistant]

All committers have signed the CLA.

[mathias-vandaele]

@vobu I believe the credentials are not good anymore, I faced this issue locally as well 🤔