Approve dependencies in pnpm and pin pnpm version in Gradle

[Gold856]

Description

Fixes failure in #2481. The pnpm version was unpinned, so it quietly moved to pnpm 11, which introduced several breaking changes including one with approved builds (specifically, strictDepBuilds). Since we're on pnpm 11 anyways, use their new system for approving postinstalls for certain dependencies.

Meta

Merge checklist:

• Pull Request title is short, imperative summary of proposed changes
• The description documents the what and why, including events that led to this PR
• If this PR changes behavior or adds a feature, user documentation is updated
• If this PR touches photon-serde, all messages have been regenerated and hashes have not changed unexpectedly
• If this PR touches configuration, this is backwards compatible with all settings going back to the previous seasons's last release (seasons end after champs ends)
• If this PR touches pipeline settings or anything related to data exchange, the frontend typing is updated
• If this PR addresses a bug, a regression test for it is added
• If this PR adds a dependency, the license has been checked for compatibility and steps taken to follow it