fix: remove fixed engines field and add npm install cooldown (#23)

# Description

Closes #7.

The `engines` field pinned exact versions of Node.js and npm. It
propagates to consumers, so installing `@line/liff-cli` printed
`EBADENGINE` warnings on any other version. I removed it and moved the
npm requirement to `devEngines`, which is not propagated.

I also added new configs to `.npmrc` as a mitigation against supply
chain attacks.

- `min-release-age=3`: It makes npm ignore versions published less than
3 days ago.
- `strict-allow-scripts=true` in `.npmrc` and `allowScripts` in
`package.json`: prevent install scripts of third-party packages from
running.

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: odanado

.npmrc

@@ -1,3 +1,4 @@
-engine-strict=true
 save-exact=true
 registry=https://registry.npmjs.org/
+min-release-age=3
+strict-allow-scripts=true

.nvmrc

@@ -1 +1 @@
-22.2.0
+24.21.0

package-lock.json

@@ -23,15 +23,24 @@
     "release": "changelogen --release"
   },
   "keywords": [],
-  "engines": {
-    "node": "22.2.0",
-    "npm": "10.7.0"
+  "devEngines": {
+    "packageManager": {
+      "name": "npm",
+      "version": ">=11.16.0",
+      "onFail": "error"
+    }
+  },
+  "allowScripts": {
+    "esbuild": false,
+    "fsevents": false,
+    "msw": false,
+    "node-pty": false
   },
   "license": "Apache-2.0",
   "devDependencies": {
     "@types/http-proxy": "1.17.15",
     "@types/inquirer": "9.0.7",
-    "@types/node": "22.2.0",
+    "@types/node": "24.13.6",
     "@typescript-eslint/eslint-plugin": "6.7.3",
     "@typescript-eslint/parser": "6.7.3",
     "changelogen": "0.5.5",