fix: Add explicit dependency for vue-loader@legacy

[danxuliu]

Current vue-loader@legacy installed as transitive has a vulnerable dependency, and there is no fix for the installed major version. When npm audit fix is run it tries to update vue-loader to another major, because no version is explicitly specified in the project. Fortunately, the postinstall script of webpack-vue-config verifies that the right version of vue-loader is installed and aborts the process (with a nice warning) if it is not.

However, due to all of the above, when npm audit fix is run by the workflow the command fails and no fix is applied (although the error is only visible when debug logs are enabled). To solve that now an explicit dependency is added again for vue-loader@legacy.

Note that the explicit dependency was removed in the past due to being automatically handled when the dependencies are installed, but it is necessary when nothing is installed and the dependency has a vulnerability.

Thanks @ShGKme for the explanation!

[danxuliu]

/backport to stable34 please

[danxuliu]

/backport to stable33 please

[danxuliu]

/backport to stable32 please

[backportbot]

The backport to stable32 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable32
git pull origin stable32

# Create the new backport branch
git checkout -b backport/1496/stable32

# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick 48073f89

# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/1496/stable32

Error: Failed to check for changes with origin/stable32: No changes found in backport branch

---

Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports.

[danxuliu]

The backport to stable32 failed. Please do this backport manually.

[...]

Error: Failed to check for changes with origin/stable32: No changes found in backport branch

I did not realize that the backport to stable32 was not needed, as vue-loader is already an explicit dependency in that branch and therefore npm audit fix works fine.