Keep the light client out of the bot images

@pezkuwi/rpc-provider lists @bizinikiwi/connect as an optional dependency,
so npm installed it, with smoldot, into both images. Both are GPL-3.0, and
the bots never load them: they reach the chains over WsProvider. The images
now install with --omit=optional; with that install both bots load and read
the relay, Asset Hub and People chains.

The lockfiles still list the packages, so Dependency Review, which denies
GPL-3.0, flagged them on the new payout-bot lockfile (the noter's had them
before). It allows exactly those three packages, and the bots job fails if
an image contains @bizinikiwi or smoldot, so the allowance cannot outlive
the reason for it.

.github/workflows/security.yml

@@ -56,6 +56,13 @@ jobs:
         with:
           fail-on-severity: high
           deny-licenses: GPL-3.0, AGPL-3.0
+          # The light client is an optional dependency of @pezkuwi/rpc-provider,
+          # so it is listed in the bots' lockfiles, but their images are built
+          # with --omit=optional and never contain it (checked in ci.yml, bots).
+          allow-dependencies-licenses: >-
+            pkg:npm/@bizinikiwi/connect,
+            pkg:npm/@bizinikiwi/connect-extension-protocol,
+            pkg:npm/@bizinikiwi/connect-known-chains
 
   secret-scan:
     name: Secret Scan