Fix scheduled API security workflow

[rksharma-owg]

Summary

• add reproducible root and vulnerable-lab dependency lockfiles
• use npm ci in the active and reusable workflows
• start the bundled vulnerable API lab and wait for its health endpoint before Newman runs
• correct the local Postman environment port and keep the reusable workflow synchronized

Root cause

The scheduled workflow enabled npm caching without a dependency lockfile, so actions/setup-node failed before dependency installation. The next step also targeted the reserved api.example.test placeholder, which could never provide a runnable scheduled test.

The workflow now runs its smoke collection against the repository's disposable localhost lab, so scheduled and pull-request executions are self-contained and do not target an external API.

Validation

• npm ci
• npm ci --prefix vulnerable-api-lab/node-api
• npm run validate:payloads
• Newman collection run against the local lab: 3 requests, 9 assertions, 0 failures
• both workflow YAML files parsed successfully
• git diff --check