GHSA-2rx9-3g3h-c2jv: pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

A crafted lockfile alias could reach several install-time filesystem joins. With --trust-lockfile or a frozen lockfile, traversal segments could create links outside the intended project or node_modules boundary. This patch validates dependency names and every virtual-store slot before creating directories, links, bins, or hoisted entries.