ci: add ignore-scripts to Node package manager config (20260527-155221)

[securityeng-bot]

This PR was generated by sec-cli github repositories ignore-scripts update.

What changed

Package managers detected: npm

Created config files:

• .npmrc

Dockerfiles updated (COPY added before install step):

• Dockerfile

Why

Running npm install (or yarn, pnpm, bun, npx) without restricting
postinstall scripts allows dependency lifecycle hooks to execute arbitrary code
during installation. Setting ignore-scripts=true (or the equivalent for your
package manager) mitigates this risk.

References:

• npm: https://docs.npmjs.com/cli/v10/using-npm/config#ignore-scripts
• yarn classic: https://classic.yarnpkg.com/lang/en/docs/configuration
• yarn berry: https://yarnpkg.com/configuration/yarnrc#enableScripts
• bun: https://bun.sh/docs/install/lifecycle

[vallieres]

@docker/registry please review and merge when you are available. 🙇🏻

[vallieres]

Approving security hardening PR: adds ignore-scripts=true to npm config to prevent supply-chain attacks via postinstall hooks. Change is minimal and correct.