chore: harden npm and yarn config

[mikesposito]

Explanation

Hardening dev environment for this repo. See https://lavamoat.github.io/guides/hardening-dev/

References

• Fixes https://consensyssoftware.atlassian.net/browse/WPN-852

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

[ulissesferreira]

Hey @mikesposito, I saw Lavamoat's guide include some extra steps including the preferred use of the package @lavamoat/harden. What do you think we do that? https://lavamoat.github.io/guides/hardening-dev/

[Mrtenz]

I'm working on a full integration of LavaMoat/harden in the core repository. This is a bit more involved than adding some config files, as the latest version of harden includes a Yarn plugin which limits permissions of package.json scripts. Still working through some bugs with Zb before we can use this in monorepos though.

[Mrtenz]

Most of this should be unnecessary, since we use Yarn.

See the module template for reference: https://github.com/MetaMask/metamask-module-template/blob/f20b5e7c1ed6f4d4e2f1beb7eb06898aa66be0c0/.npmrc

[Mrtenz]

If you add a devEngines config, npm is completely disabled.

https://github.com/MetaMask/metamask-module-template/blob/f20b5e7c1ed6f4d4e2f1beb7eb06898aa66be0c0/package.json#L91-L97

[mikesposito]

Closing this until this work is done on core