chore: release 4.2.4

[oc-tmueller]

Release preparation for the ownCloud 10.16.5 line.

The reason to cut this: no released version of the app carries the return-URL validation
yet. v4.2.3 was tagged 2026-05-18 and #621 landed after it.

Two commits, and the first one is a prerequisite

1. ci: add signed release workflow [4.2] — this branch had no release.yml at all,
   only main.yml and security-scan.yml. Releases are tag-triggered and GitHub resolves the
   workflow from the tagged commit, so tagging 4.2 today would produce no release and no
   signed artifact. Copied verbatim from master: the reusable workflow takes no php-version
   input, so nothing needs adapting for 7.4, and it signs with the repository's
   SIGNING_KEY/SIGNING_CERT/SIGNING_CHAIN secrets, which are available on any branch.
2. chore: bump version to 4.2.4 — appinfo/info.xml and a new CHANGELOG.md section.

Contents of 4.2.4

• Security — fix: only navigate to a validated absolute http(s) return URL [4.2] #621, the validated return URL and the narrowed WOPI post-message origin
• Fixed — the pnpm settings move and lockfile repairs (fix(deps): bring the 4.2 dependency tree to parity with master #625, fix(deps): move pnpm settings to pnpm-workspace.yaml and reinstate the pins #632, fix(deps): restore the pnpm overrides dropped from the lockfile [4.2] #633)
• Changed — the JS unit test harness (test: add a javascript unit test harness for the classic frontend [4.2] #630), the appstore removal (build: drop the appstore target in favour of dist [4.2] #635), dependency
  bumps (chore(deps-dev): bump bamarni/composer-bin-plugin from 1.8.2 to 1.9.1 in the minor-and-patch group #627, chore(deps-dev): bump vue from 3.5.40 to 3.5.42 in the minor-and-patch group #629, chore(deps-dev): bump the minor-and-patch group with 3 updates #638)

Verification

The build path this branch had never run works. In owncloudci/php:8.3 (the runner's PHP,
Composer 2.9.8), make dist runs composer install --no-dev, which honours the
config.platform.php: 7.3 lock — "Verifying lock file contents can be installed on current
platform… Nothing to install" — and produces a 167-entry, 236 kB tarball.

appinfo/info.xml reads 4.2.4, so the reusable workflow's tag check will pass for v4.2.4.
Signing is the only step not exercised locally; it runs in CI from repo secrets.

Tagging follows once this is merged. The marketplace upload (published there as
"Collabora Online", currently 4.2.3) is a separate manual step.