Keep the light client out of the bot images

@pezkuwi/rpc-provider lists @bizinikiwi/connect as an optional dependency,
so npm installed it, with smoldot, into both images. Both are GPL-3.0, and
the bots never load them: they reach the chains over WsProvider. The images
now install with --omit=optional; with that install both bots load and read
the relay, Asset Hub and People chains.

The lockfiles still list the packages, so Dependency Review, which denies
GPL-3.0, flagged them on the new payout-bot lockfile (the noter's had them
before). It allows exactly those three packages, and the bots job fails if
an image contains @bizinikiwi or smoldot, so the allowance cannot outlive
the reason for it.

payout-bot/Dockerfile

@@ -4,9 +4,11 @@ WORKDIR /app
 
 # Install exactly what package-lock.json records, so the image runs the
 # versions that were reviewed and tested rather than whatever the ranges
-# resolve to on the day it is built.
+# resolve to on the day it is built. The optional dependencies are the light
+# client (@bizinikiwi/connect, smoldot), which the bot never loads: it talks to
+# the chains over WsProvider.
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev --no-audit --no-fund
+RUN npm ci --omit=dev --omit=optional --no-audit --no-fund
 
 COPY bot.js ./