chore(security): no .npmrc, so the dependency cooldown is advisory only

### Problem There is no `.npmrc` at the repository root or in `superset-frontend/`, so npm installs have no `minimumReleaseAge` cooldown. Every `npm install`/`npm ci` will happily resolve a version published seconds ago. Dependabot's own cooldown settings only govern what Dependabot proposes. They do nothing for a developer's local install, a Docker build, or a CI job — and `docker/docker-frontend.sh` currently runs a bare `npm install` (apache/superset#42979), which discards the lockfile as well. The npm ecosystem has had several self-propagating worm incidents where the window between a malicious publish and its takedown was measured in hours. A cooldown is the cheapest control that closes that window. ### Proposed change Add an `.npmrc` setting a minimum release age (7 days matches the Dependabot cooldown already in use), so every install path inherits it rather than relying on each one being configured correctly. Verified against `master` at `3539c41dab`.