build: add Socket Security (SFW) integration with configurable vulnerability scanning

[pradeepjangid195]

Summary

Integrates Socket Security (SFW) into the BitGoJS build pipeline to enhance supply chain security by scanning
dependencies for vulnerabilities during installation and build processes.

Changes

• GitHub Actions CI/CD: Added Socket Security scanning to all workflow jobs

  • Updated .github/workflows/ci.yml with Socket Security integration
  • Updated .github/workflows/publish.yml with Socket Security integration
  • All yarn commands now run through sfw wrapper for security scanning

• Docker Build: Enhanced Dockerfile with Socket Security support

  • Installs sfw globally in builder stage
  • All dependency installations scanned by Socket Security
  • Configurable via SOCKET_SECURITY_MODE build argument

• Configurable Security Mode: Added SOCKET_SECURITY_MODE environment variable

  • monitor (default, non-blocking): Logs vulnerabilities but allows build to proceed
  • block: Fails build on detection of vulnerabilities
  • Can be configured per environment (CI, Docker, etc.)

Benefits

• Proactive detection of malicious packages and vulnerabilities in dependencies
• Configurable enforcement: start with monitoring, move to blocking as needed
• Integrated into existing CI/CD pipeline with minimal disruption

Ticket: VL-3832