Fail-closed npm and PyPI vulnerability checks in n8n

A repeatable exact-version OSV and CISA KEV workflow that keeps registry and vulnerability-source failures visible.