Add npm cooldown for minimal age of releases

[Odilhao]

Introduces minimal age for npm packages, this allow us to have less exposure to compromised npm packages.

[adamruzicka]

According to the changelog[1], the min-release-age was released in npm-11.10.0. Should we also bump required npm version from >=8.0.0 to >=11.10.0?

[1] - https://github.com/npm/cli/releases/tag/v11.10.0

[stejskalleos]

Introduces minimal age for npm packages, this allow us to have less exposure to compromised npm packages.

As someone who never heard of this feature, I would welcome more descriptive commit message on what exactly is going on and how does it work, for example when package is too new and so on.

• @adamruzicka's comment seems to be valid.

[adamruzicka]

To elaborate on my previous comment, on my primary dev machine I seem to have npm-10.9.8. With this change applied, I'd have false sense of security while npm merilly ignores the unknown entry