Improve npm package installation security

[microbit-grace]

.npmrc:

• min-release-age=7 (cooldown; @microbit/* and @microbit-foundation/* exempt)
• allow-git/remote/file/directory=root (block transitive non-registry deps)
• strict-allow-scripts=true + engine-strict=true

package.json:

• Add engine restrictions (node >= 24, npm >= 11.18) to all packages, including ones that are not used in practice. (We only use browser-pyright in the Python
• allowScripts have been configured so that npm i doesn't fail. fsevents scripts have been allowed. keytar scripts have been disallowed.
• Upgrade webpack to 5.76 so that npm run build in browser-pyright works in node 24.

package-lock.json files in all 4 packages have been regenerated.

validation.yml - Updated node and npm versions, though in practice, they do not run in this forked repo (guarded by github.repository == 'microsoft/pyright').

[microbit-grace]

Broke npm run build in browser-pyright package. It works ok with node 14, but not with node 24.

Update: Fixed by dcc23c1