Verify SHASUMS.txt before installing Node

[sapphi-red]

Description

Node signs the SHASUMS256.txt that contains the checksums of each binaries with a PGP signature. The way to verify is explained at https://github.com/nodejs/node#verifying-binaries.
But viteplus does not currently verify that.

This makes it difficult to attack Node.

Suggested solution

Download SHASUMS256.txt.asc instead and verify it here:

vite-plus/crates/vite_js_runtime/src/runtime.rs

Lines 183 to 184 in 491cd3f

	let shasums_content = download_text(url).await?;
	Some(provider.parse_shasums(&shasums_content, &download_info.archive_filename)?)

Alternative

No response

Additional context

No response

Validations

• Read the Contributing Guidelines.
• Confirm this request is for Vite+ itself and not for Vite, Vitest, tsdown, Rolldown, or Oxc.
• Check that there isn't already an issue requesting the same feature.