chore: Minimum release age of one week

[lanesawyer]

This PR resolves #934 by adding a min-release-age of 7 days to the .npmrc file. It alo updates the minimum Node version to 24, since that's the version that has the npm CLI with the min-release-age feature.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[lanesawyer]

Ah, getting some build failures because --before is being used, which is mutually exclusive with min-release-age. I'll take a look at that!

[jbms]

Yes, seems like an npm bug.

A few things to note:

(1) Neuroglancer has a lot of build-time JavaScript dependencies but very few runtime JavaScript dependencies, and the runtime JavaScript dependencies are unlikely to pose security risks assuming they aren't malicious. The build-time dependencies aren't exposed and therefore only malicious packages are a risk there. Therefore, there is little reason to proactively update dependencies --- instead that can be done just as needed for new functionality.

(2) The min-release-age setting is only relevant when updating the lockfile, but I guess npm also just validates it all the time? That is unfortunate because in some case we may want to specifically use a newer version for some reason and we don't want a check failing as a result.

[lanesawyer]

1. Yeah, makes sense. I noticed Dependabot isn't configured to run regularly (and I was actually about to propose using it) but if it's not a need that sounds good!

2. Yeah, that's why I'm a big fan of pnpm, they have a setting for excluding certain packages from the minimum release age check. After a quick search, I'm not finding npm has the same option yet... Of all the package managers, npm is the one moving slowest in this regard 😞