Implement safeguards for NPM packages

[davisshaver]

NPM package exploits are a common vulnerability for web3 apps. While we can't eliminate this risk for implementors, we can take some steps to reduce it. These steps could include:

• Dependabot integration for security advisories
• Audit CI integration for security advisories
• Restrict preinstall and postinstall with LavaMoat (background here) – although LavaMoat may be unnecessary here since pnpm supports this out of the box
• Pin packages to specific versions

[holic]

Pinning was done in #48