chore: Disallow Git dependencies

[FrederikBolding]

Bump Yarn to v4 and disallow Git dependencies. Additionally add npmMinimalAgeGate and other properties from the module template.

---

Note

Medium Risk
Changes package manager and install-time policies (Git dependency allowlist, script execution, and npm age gating), which can affect dependency resolution and CI/build reproducibility.

Overview
Upgrades the repo to Yarn v4 (packageManager: yarn@4.14.1 and new yarnPath release) and tightens install-time security defaults.

Yarn is now configured to disallow all Git-based dependencies (approvedGitRepositories: []), disable package install scripts, and enforce an npm publish-age gate with a small allowlist (npmMinimalAgeGate / npmPreapprovedPackages). A plugin-allow-scripts hook is added to run allow-scripts after installs, with corresponding lavamoat.allowScripts configuration in package.json.

^{Reviewed by Cursor Bugbot for commit 9c12f2d. Bugbot is set up for automated code reviews on this repo. Configure here.}