ci: pin the validator's ajv dependencies in a root package.json and install with npm ci

[deanrie]

Why

Piece 2 of #531. The validate workflow runs npm install --no-save ajv ajv-formats on every job, so each run resolves whatever ajv and ajv-formats are current. A major release of either (schema draft handling, format defaults) can turn CI red or, worse, quietly change what the schema check accepts, with no commit in this repo to bisect.

What

• package.json at the repo root, private, with ajv 8.20.0 and ajv-formats 3.0.1 as exact devDependencies and a validate script. The plugins themselves have no runtime dependencies; this is repo tooling only.
• package-lock.json (7 packages).
• .github/workflows/validate-plugins.yml: npm ci with the npm cache enabled in setup-node, npm run validate, and scripts/**, the two package files and the workflow itself added to the paths: trigger so a change to the validator or its dependencies runs the job. (ci: validate every PR and check declared plugin component paths exist #582 drops the filter entirely; whichever lands second has a two-line rebase.)

Checked

rm -rf node_modules && npm ci && npm run validate on current main: All plugins validated successfully. Local run with the same versions matches what the workflow installs today, so no behaviour change in the check itself.

Refs #531.

[deanrie]

Superseded by #618, which carries this commit together with the other two #531 CI pieces as one reviewable PR.