Mitigate supply chain attacks with npmMinimalAgeGate and Lavamoat (#88)

* Upgrade yarn from 4.2.2 to 4.10.0

* Add lavamoat allow-scripts and preinstall-always-fail

Author: jeffsmale90

.yarn/releases/yarn-3.2.1.cjs

@@ -15,3 +15,5 @@ nodeLinker: node-modules
 plugins:
   - path: .yarn/plugins/@yarnpkg/plugin-allow-scripts.cjs
     spec: 'https://raw.githubusercontent.com/LavaMoat/LavaMoat/main/packages/yarn-plugin-allow-scripts/bundles/@yarnpkg/plugin-allow-scripts.js'
+
+npmMinimalAgeGate: 4320

.yarnrc.yml

@@ -12,7 +12,6 @@
     "packages/*"
   ],
   "scripts": {
-    "allow-scripts": "echo 'n/a'",
     "build": "turbo build",
     "build:packages": "turbo run build --filter='!./packages/delegator-e2e'",
     "changelog:update": "turbo run changelog:update --filter='!./packages/delegator-e2e'",
@@ -28,6 +27,8 @@
     "test:watch": "turbo run test:watch"
   },
   "devDependencies": {
+    "@lavamoat/allow-scripts": "^3.4.0",
+    "@lavamoat/preinstall-always-fail": "^2.1.1",
     "@metamask/create-release-branch": "^4.1.1",
     "@metamask/eslint-config": "^12.0.0",
     "@metamask/eslint-config-nodejs": "^12.0.0",
@@ -55,11 +56,17 @@
     "viem": "2.31.4",
     "webauthn-p256": "^0.0.10"
   },
-  "packageManager": "yarn@4.2.2",
+  "packageManager": "yarn@4.10.0",
   "engines": {
     "node": "^18.18 || >=20"
   },
   "resolutions": {
     "elliptic": "^6.6.1"
+  },
+  "lavamoat": {
+    "allowScripts": {
+      "@lavamoat/preinstall-always-fail": false,
+      "keccak": false
+    }
   }
 }