SK-2839: Pin dependency versions and add --ignore-scripts to harden against supply chain attacks

[saileshwar-skyflow]

Summary

• Pin all package.json versions to exact lock-file versions — removes all ^ and ~ range specifiers from dependencies and devDependencies so the registry can never serve a different version than what was tested
• Add --ignore-scripts to every CI npm install/npm ci call in .github/workflows/ — blocks lifecycle scripts (postinstall, preinstall, etc.) from executing at install time in CI
• Create .npmrc with ignore-scripts=true as a project-level default, applying the same protection for local installs

Hardens the repo against the Mini Shai-Hulud / Shai-Hulud npm supply chain attack campaign.

Files changed

File	Change
package.json	31 range specifiers (^/~) replaced with exact lock-file versions
.github/workflows/common-ci.yml	npm install → npm install --ignore-scripts
.github/workflows/contract-tests.yml	npm ci → npm ci --ignore-scripts
.github/workflows/common-release.yml	npm install → npm install --ignore-scripts
.npmrc	Created with ignore-scripts=true

[github-actions]

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

[github-actions]

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.