Require VS Code consent for custom theme checks

[aswamy]

What this changes

Custom Theme Checks remain supported, but the Shopify Liquid VS Code extension now asks for explicit consent before loading JavaScript selected by a theme configuration.

• discover explicit, inherited, and automatically discovered custom checks before calling require()
• ask through the language client with Run once, Always allow for this workspace, and Keep disabled choices
• deny without prompting when VS Code marks the workspace untrusted
• persist “always allow” decisions in VS Code workspace state, outside the theme
• fingerprint the theme root and full candidate set so adding or changing a requested path prompts again
• continue running built-in checks when custom checks are denied
• preserve existing behavior for CLI and other language-server clients

Scope

This PR intentionally covers the VS Code path only. CLI policy and consent for other LSP clients can be considered separately. The browser extension cannot load Node custom checks and is unchanged.

Validation

• pnpm build:ts
• pnpm exec vitest --run packages/theme-check-node/src packages/theme-language-server-node/src packages/vscode-extension/src/node (91 tests)
• affected package type checks
• VS Code webpack development bundle
• ESLint on the changed VS Code client files

The repository-wide VS Code lint command still reports existing errors in browser globals and the existing debugger statement in src/node/server.ts; this change introduces no new lint errors.