Update packages to address vulnerabilities (#2648)

## Summary
Update packages in devbox repo to address any vulnerabilities:
- Updated drupal and other devbox examples
- Update to typeid/v2
- Update to latest dependencies on opensource/pkg (and by extension
update the transitive extract/v3 dependency to extract/v4)

## How was it tested?
Ran all tests but ... tests do seem to be hanging and timing out. Hoping
someone has run into this issue to help debug and make sure the tests do
pass.

## Community Contribution License

All community contributions in this pull request are licensed to the
project
maintainers under the terms of the
[Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0).

By creating this pull request, I represent that I have the right to
license the
contributions to the project maintainers under the Apache 2 License as
stated in
the
[Community Contribution
License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).

0.15.0 Release

release lock on global process-compose before attaching (#2645)

## Summary
After running `devbox services attach` all other `devbox services ...`
commands hang until the attached UI is exited. This is because there's a
lock put on the global process-compose file while it's being read and
it's not released until the program exits.

You can see in `devbox services up` the lockfile is released, looks like
it was just missed in attach.


https://github.com/jetify-com/devbox/blob/dd069a42b8cae746d93e2cd7ad5665b722a1973f/internal/services/manager.go#L188-L189



## How was it tested? (repro steps, hangs without this PR, works as
expected with it)

In one terminal, in a devbox repo with process(es)
```sh
devbox services up -b
devbox services attach
```
In another terminal, in the same dir or any other devbox repo>
```sh
devbox services ls # or any services ... sub command
# will hang until <ctrl-c> in above terminal
```

## Other note

The `lock()` function has a timeout and error handling, why doesn't it
work?


https://github.com/jetify-com/devbox/blob/dd069a42b8cae746d93e2cd7ad5665b722a1973f/internal/services/manager.go#L374-L394

The line that hangs is 391, when we're trying to close the file after
the timeout, the file can't be closed because another process has it
open and/or locked. I did investigate adding a timeout `file.Close()`
but could not get it to work reliably for myself.

## Community Contribution License

All community contributions in this pull request are licensed to the
project
maintainers under the terms of the
[Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0).

By creating this pull request, I represent that I have the right to
license the
contributions to the project maintainers under the Apache 2 License as
stated in
the
[Community Contribution
License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).

Auto Assign Reviewers for PRs (#2643)

## Summary

TSIA, add myself + 1 random reviewer from our eng org. 

## How was it tested?

## Community Contribution License

All community contributions in this pull request are licensed to the
project
maintainers under the terms of the
[Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0).

By creating this pull request, I represent that I have the right to
license the
contributions to the project maintainers under the Apache 2 License as
stated in
the
[Community Contribution
License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).

---------

Signed-off-by: John Lago <750845+Lagoja@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

[runx] Use standard github token env name (#2635)

## Summary

## How was it tested?

## Community Contribution License

All community contributions in this pull request are licensed to the
project
maintainers under the terms of the
[Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0).

By creating this pull request, I represent that I have the right to
license the
contributions to the project maintainers under the Apache 2 License as
stated in
the
[Community Contribution
License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).

[completion] Fix shell completion when specifying --config flag (#2632)

## Summary

Narrow fix to completion when passing `-c`, `--config` flags.

## How was it tested?

Used tab completion when using `-c` flag and it worked.

## Community Contribution License

All community contributions in this pull request are licensed to the
project
maintainers under the terms of the
[Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0).

By creating this pull request, I represent that I have the right to
license the
contributions to the project maintainers under the Apache 2 License as
stated in
the
[Community Contribution
License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).

add GITHUB_TOKEN to some GHA workflows (#2624)

## Summary

Got this error from a recent CICD failure:

https://github.com/jetify-com/devbox/actions/runs/15422512862/job/43401117195
```
Error: nix: command error: nix --extra-experimental-features ca-derivations --option experimental-features 'nix-command flakes fetch-closure' flake metadata --json github:NixOS/nixpkgs/nixpkgs-unstable: unable to download 'https://api.github.com/repos/NixOS/nixpkgs/commits/nixpkgs-unstable': HTTP error 403: exit code 1

time=2025-06-03T16:18:44.819Z level=ERROR source=/Users/runner/work/devbox/devbox/internal/boxcli/midcobra/debug.go:68 msg="command error" stderr="error:\n       … while fetching the input 'github:NixOS/nixpkgs/nixpkgs-unstable'\n\n       error: unable to download 'https://api.github.com/repos/NixOS/nixpkgs/commits/nixpkgs-unstable': HTTP error 403\n\n       response body:\n\n       {\"message\":\"API rate limit exceeded for 13.105.117.137. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)\",\"documentation_url\":\"https://docs.github.com/rest/overview/resources-in-the-rest-api#rate-limiting\"}\n" execid=56fcbe21ff4a4759b3aa59c59d79e8a8 stack=<nil>
```
...
```
 time=2025-06-03T16:18:44.820Z level=DEBUG source=/Users/runner/work/devbox/devbox/internal/nix/flake.go:27 msg="nix command starting" cmd.args="nix --extra-experimental-features ca-derivations --option experimental-features 'nix-command flakes fetch-closure' flake metadata --json github:NixOS/nixpkgs/nixpkgs-unstable"
time=2025-06-03T16:18:45.030Z level=DEBUG source=/Users/runner/work/devbox/devbox/internal/nix/flake.go:27 msg="nix command exited" cmd.args="nix --extra-experimental-features ca-derivations --option experimental-features 'nix-command flakes fetch-closure' flake metadata --json github:NixOS/nixpkgs/nixpkgs-unstable" cmd.path=/nix/var/nix/profiles/default/bin/nix cmd.stderr="unable to download 'https://api.github.com/repos/NixOS/nixpkgs/commits/nixpkgs-unstable': HTTP error 403" cmd.pid=2817 cmd.code=1 cmd.dur=210.690417ms
```

I think we need to add GITHUB_TOKEN for a couple of jobs that setup
Devbox

## How was it tested?

will hope that CICD passes

## Community Contribution License

All community contributions in this pull request are licensed to the
project
maintainers under the terms of the
[Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0).

By creating this pull request, I represent that I have the right to
license the
contributions to the project maintainers under the Apache 2 License as
stated in
the
[Community Contribution
License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).

add GITHUB_TOKEN to some GHA workflows (#2624)

## Summary

Got this error from a recent CICD failure:

https://github.com/jetify-com/devbox/actions/runs/15422512862/job/43401117195
```
Error: nix: command error: nix --extra-experimental-features ca-derivations --option experimental-features 'nix-command flakes fetch-closure' flake metadata --json github:NixOS/nixpkgs/nixpkgs-unstable: unable to download 'https://api.github.com/repos/NixOS/nixpkgs/commits/nixpkgs-unstable': HTTP error 403: exit code 1

time=2025-06-03T16:18:44.819Z level=ERROR source=/Users/runner/work/devbox/devbox/internal/boxcli/midcobra/debug.go:68 msg="command error" stderr="error:\n       … while fetching the input 'github:NixOS/nixpkgs/nixpkgs-unstable'\n\n       error: unable to download 'https://api.github.com/repos/NixOS/nixpkgs/commits/nixpkgs-unstable': HTTP error 403\n\n       response body:\n\n       {\"message\":\"API rate limit exceeded for 13.105.117.137. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)\",\"documentation_url\":\"https://docs.github.com/rest/overview/resources-in-the-rest-api#rate-limiting\"}\n" execid=56fcbe21ff4a4759b3aa59c59d79e8a8 stack=<nil>
```
...
```
 time=2025-06-03T16:18:44.820Z level=DEBUG source=/Users/runner/work/devbox/devbox/internal/nix/flake.go:27 msg="nix command starting" cmd.args="nix --extra-experimental-features ca-derivations --option experimental-features 'nix-command flakes fetch-closure' flake metadata --json github:NixOS/nixpkgs/nixpkgs-unstable"
time=2025-06-03T16:18:45.030Z level=DEBUG source=/Users/runner/work/devbox/devbox/internal/nix/flake.go:27 msg="nix command exited" cmd.args="nix --extra-experimental-features ca-derivations --option experimental-features 'nix-command flakes fetch-closure' flake metadata --json github:NixOS/nixpkgs/nixpkgs-unstable" cmd.path=/nix/var/nix/profiles/default/bin/nix cmd.stderr="unable to download 'https://api.github.com/repos/NixOS/nixpkgs/commits/nixpkgs-unstable': HTTP error 403" cmd.pid=2817 cmd.code=1 cmd.dur=210.690417ms
```

I think we need to add GITHUB_TOKEN for a couple of jobs that setup
Devbox

## How was it tested?

will hope that CICD passes

## Community Contribution License

All community contributions in this pull request are licensed to the
project
maintainers under the terms of the
[Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0).

By creating this pull request, I represent that I have the right to
license the
contributions to the project maintainers under the Apache 2 License as
stated in
the
[Community Contribution
License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).

Update Docs dependencies (#2618)

## Summary

Update doc dependencies, including algolia, to fix an issue with algolia
search

## How was it tested?

Tested algolia before and after upgrading locally, confirmed bug + fix

## Community Contribution License

All community contributions in this pull request are licensed to the
project
maintainers under the terms of the
[Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0).

By creating this pull request, I represent that I have the right to
license the
contributions to the project maintainers under the Apache 2 License as
stated in
the
[Community Contribution
License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).