docs: clarify trustedDependencies replaces the default allow list (#31027)

## What

Closes #31026.

The `trustedDependencies` docs at `docs/pm/lifecycle.mdx` don't explain
what happens when the field is set to an empty array. Users reasonably
assume `"trustedDependencies": []` would add nothing on top of the
default top-500 list — but it actually disables the default list
entirely.

## Behavior (verified against source)

From `Lockfile.hasTrustedDependency` in `src/install/lockfile.zig:2126`:

```zig
pub fn hasTrustedDependency(this: *const Lockfile, name: []const u8, resolution: *const Resolution) bool {
    if (this.trusted_dependencies) |trusted_dependencies| {
        const hash = @as(u32, @truncate(String.Builder.stringHash(name)));
        return trusted_dependencies.contains(hash);
    }
    // Only allow default trusted dependencies for npm packages
    return resolution.tag == .npm and default_trusted_dependencies.has(name);
}
```

The parser (`src/install/lockfile/Package.zig:1556`) initialises
`lockfile.trusted_dependencies` to a non-null empty map the moment the
`trustedDependencies` key is present — even if the array is empty. So
the fallback to the default list is only reached when the key is
**absent** from `package.json`. Three cases:

| `package.json` | Trusted packages |
|---|---|
| key omitted | the ~500 built-in defaults (npm sources only) |
| `["pkg"]` | only `pkg` — default list ignored |
| `[]` | nothing — default list ignored |

## Change

Adds a short subsection + table to `docs/pm/lifecycle.mdx` covering all
three cases, and notes that the field **replaces** rather than extends
the default list. Docs-only, no code changes.

---------

Co-authored-by: Alistair Smith <hi@alistair.sh>