Add yes=false to .npmrc to prevent npx auto-install

DEV-376: defense-in-depth alongside the CI policy in DEV-375.
Equivalent to passing --no to every npx invocation.

Linear: https://linear.app/mixpanel/issue/DEV-376

Author: jinhyoo-mp

.npmrc

@@ -1,2 +1,5 @@
 # Prevent supply chain attacks
 min-release-age=7
+# Stop `npx` from silently downloading packages not in node_modules.
+# Equivalent to passing `--no` to every `npx` invocation.
+yes=false