This PR moves the size comparison action back to a separate workflow
which now uses the `pull_request_target` event. This event is triggered
at all the same times as the `pull_request` action, except that the
workflow file content comes from the target branch of the PR, and it is
run in the context of the repo owning the target branch. Practically,
this means that it will still have access to post a comment even if the
PR comes from a fork.

We don’t want the build actions to be run in a `pull_request_target`
workflow because they would get access to the secrets and be able to
perform arbitrary actions on the repository, even from fork PRs.

See the current version failing here:
https://github.com/actualbudget/actual/actions/runs/5395184895/jobs/9797388016?pr=1122

actual-server does not need to import the full actual-app/api package.
It can import only the CRDT stuff.. so I'm extracting it into a new
package to reduce the size of actual-server and make the link between
things more transparent.

Updates to the latest version of electron and moves the backend-frontend
communication from node-ipc to websockets. This resolves the previous
roadblock regarding `nodeIntegration` .

Done

- Remove node-ipc in favour of websockets. 
- Move file copying out of `preload.js` to avoid importing module `fs`
there
- Bump all electron pacakge versions to the latest
- Added new package for finding open ports as node-ipc is gone
- Tweaked webpack config for above changes


Partially fixes #468

Questions/ Pending:
- Literally every single test fails for me, presumably some issue with
my setup/environment.
- The websocket communication is not using TLS. I'm not sure how to
enable this, or if we even need to as its all local.
- Still need to create the CI for building/deploying but I'm not sure
where start in this regard as i have no exp with it. Presumably we will
need to point the electron auto-updater to the github releases url's. If
people are happy with this PR I will look at adding the CI before its
merged.
- In dev mode only, I have disabled TLS security becuase my docker
container's cert is not signed. I _assume_ this will be true for other
people who spin up the server on thier own hardware. Perhaps I just need
to change my cert to one from letsencrypt or something...

Notes.
I have not touched javascript in eons so my apologies if the commit
trail is a bit fragmented. I tried to keep them fairly contained and
then there is a slightly gnarly final commit fixing all the linter
issues... Please let me know if you want me to squash some commits etc.

I initially tried to move this to web workers the same way the web app
does it but this was unsuccessful. I have found no way to spin up a
worker in one place (frontend/backend) and then pass this worker to the
other. The electron ipc channels don't allow you to directly pass
objects such as workers, everything is cloned/serialised. Passing a port
number so the other end can spin up its own socket works fine.

---------

Co-authored-by: Shazib Hussain <contact@shazib.com>
Co-authored-by: Jed Fox <git@jedfox.com>

Part of fixing the horrendously slow Docker build for the server edge
images.

*   upgrade github actions

* Upgrade actions/checkout

* Make it easier to build the bundle.api.js for the API

* Remove budgetId parameter, move config to top level of API

* that’s a breaking change

* Add support for signing into the server in init()

* Add api.downloadBudget(syncId, { password }) method

* Fix lint errors

* Refactor: extract out getSyncError

* api/download-budget: sync if possible instead of downloading

* Don’t bother with fetching remote files and installing key if the file is local

* *groupId

* FIx lint issues

* Remove extra close+reopen

* Refactor out duplicate load-budget logic

* Trailing commas

windows is currently defaulting to powershell