chore: enforce npm min-release-age dependency cooldown

[joker23]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

Supply chain hardening for legacy SDK repositories, mirroring js-core's yarn npmMinimalAgeGate: 4320 (3 days).

Describe the solution you've provided

• Add .npmrc with min-release-age=3, so npm resolves only versions published more than 3 days ago. Unlike a Dependabot-level setting, this applies to every install — local development and CI alike.
• CI installs npm@^11.9.1 before npm install so the gate is actually enforced there (earlier npm ignores the config with an "Unknown project config" warning). Because that npm requires node >=20.17, the node 18 matrix entry is raised to node 20 (node 18 is EOL).

Describe alternatives you've considered

• Dependabot cooldown: only governs Dependabot PRs, and these legacy repos aren't aiming to stay continuously updated.
• npm 12's min-release-age-exclude to exempt LaunchDarkly-owned packages: would let fresh first-party releases through, but npm 12 requires node >=22.22, narrowing the CI matrix further.

Additional context

Verified locally: npm install + tests pass with the gate active on this branch.

Merge order: this depends on the launchdarkly-js-sdk-common 5.8.3 bump (#76) having aged past the cooldown window — CI here will fail until roughly 3 days after that release, so this should land after that point.

Link to Devin session: https://app.devin.ai/sessions/566f0d951dfa4568b67ad0c6c1cfb7c1
Requested by: @joker23

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

@cursor review

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.