build: add yarn cooldown support (3 days) + upgrade yarn@4.10.3 (#530)

Upgrading `yarn` to use the cooldown feature to avoid pulling packages
that are "too recent". Extra layer of protection against compromised
packages with supply-chain attacks.

We already use the same mechanism in `snaps` and `core`, I just re-used
the same value.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Build tooling changes affect dependency installation behavior and
could break CI or local installs if packages aren’t old enough or not
preapproved, but no runtime application logic is modified.
> 
> **Overview**
> Upgrades the repo’s Yarn version to `yarn@4.10.3` and updates
configuration to enforce a **3-day `npmMinimalAgeGate`** during
installs.
> 
> Adds an allowlist via `npmPreapprovedPackages` (e.g., `@metamask/*`,
`@lavamoat/*`) so selected scoped packages can bypass the age gate.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
777d2bc. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: ccharly

.yarn/releases/yarn-4.10.3.cjs

@@ -4,7 +4,7 @@ enableGlobalCache: false
 
 enableScripts: false
 
-enableTelemetry: false
+enableTelemetry: 0
 
 logFilters:
   - code: YN0004
@@ -16,4 +16,18 @@ plugins:
   - path: .yarn/plugins/@yarnpkg/plugin-allow-scripts.cjs
     spec: "https://raw.githubusercontent.com/LavaMoat/LavaMoat/main/packages/yarn-plugin-allow-scripts/bundles/@yarnpkg/plugin-allow-scripts.js"
 
-yarnPath: .yarn/releases/yarn-4.5.0.cjs
+yarnPath: .yarn/releases/yarn-4.10.3.cjs
+
+# Configure the NPM minimal age gate to 3 days, meaning packages must be at
+# least 3 days old to be installed.
+npmMinimalAgeGate: 4320 # 3 days (in minutes)
+
+# Override the minimal age gate, allowing certain packages to be installed
+# regardless of their publish age.
+npmPreapprovedPackages:
+  - '@metamask/*'
+  - '@metamask-previews/*'
+  - '@lavamoat/*'
+  - 'lavamoat'
+  - 'lavamoat-core'
+  - 'lavamoat-tofu'