Improve npm installation security

[microbit-grace]

.npmrc:

• min-release-age=7 (cooldown; @microbit/* and @microbit-foundation/* exempt)
• allow-git/remote/file/directory=root (block transitive non-registry deps)
• strict-allow-scripts=true + engine-strict=true

package.json:

• targetted allowScripts policy (esbuild, fsevents)
• packageManager: 11.18.0 - CloudFlare Pages uses Corepack to manage package managers including npm. This allows CloudFlare deployments to use a later version of npm than the corresponding node version defined in .node-version.

.node-version:

• For defining node version for building and deploying pages via CloudFlare.

CI workflows:

• bump GitHub-provided actions (checkout v7, setup-node v6,
  upload-pages-artifact v5, deploy-pages v5)
• grab latest v11 npm directly after setup-node

Regenerated package-lock.json under the new install policy (drops the stale apps/capacitor entry).

[microbit-grace]

Branch Preview URL: https://npm-update.python-editor-embed.pages.dev/

[cloudflare-workers-and-pages]

Deploying python-editor-embed with    Cloudflare Pages

Latest commit:	fdc4789
Status:	✅  Deploy successful!
Preview URL:	https://68864e9a.python-editor-embed.pages.dev
Branch Preview URL:	https://npm-update.python-editor-embed.pages.dev

View logs