Electron Releases

Repacks the locale .pak files against a resource allowlist derived from the binary itself, and adds a build-time check that every resource the binary can request is actually shipped.

• enable grit resource allowlisting in release builds; the allowlist is extracted from the electron executable's exact link inputs via a --collect-inputs-only pseudo-link, regenerated every build, no hand-maintained list
• repack locales/*.pak with that allowlist (only strings reachable from native code are kept)
• add electron_resource_allowlist_check, which fails the build if a referenced resource is missing from the shipped paks — and pack everything it found missing today (components_branded_strings error-page / Web Bluetooth strings, content-layer chrome:// internals pages, extension renderer bindings, theme/autofill/lottie resources referenced via grit resource maps)
• one-line Chromium patch to allow allowlist generation for desktop Linux/macOS

Enabled for both testing and release builds, so the allowlist check acts as a PR CI gate: a change that references an unshipped resource fails its own CI instead of the next release build. The first CI runs after this lands will be slower while compile caches repopulate (the grit-generated headers all change).

Verified against a full-pak build: localized strings (en/de/ja/hi), DevTools, PDF viewer, printToPDF, chrome://histograms. Windows (PDB extraction) and macOS (Mach-O support in the upstream script) are follow-ups; on those platforms this change only adds inert marker symbols.

Notes: Reduced the Linux distribution size by ~37 MB by only shipping locale strings and resources that Electron can actually use.