docs: document the allowScripts field in package.json

[Nohgh]

The allowScripts field is documented in the npm approve-scripts and npm deny-scripts command docs, but it is missing from the package.json field reference.

This adds a dedicated section so the field can be found alongside related fields like scripts.

What's included

• Placed the new section right after scripts, since it governs which
  dependencies may run their lifecycle scripts
• Documented the default blocking behavior, version-pinned vs name-only
  entries, and the false (deny) semantics, matching the wording of the
  existing command docs
• No behavior changes — documentation only

References

• npm approve-scripts docs
• npm deny-scripts docs