Revive RFC npm#488: Make install scripts opt-in

Rewrite the RFC from scratch. The original was from 2021 and predated
pnpm blocking scripts by default, the prebuild pattern replacing
node-gyp for most native addons, and several major postinstall attacks.

- Replace 2018-2021 incident references with 2024-2026 attacks
- Add allowScripts field in package.json (modeled on pnpm's allowBuilds)
- Add npm approve-scripts interactive command
- Add lockfile-based detection of unexpected script changes
- Add Scope, Prior Art, and Migration Plan sections
- Address all 6 review thread items from the original PR

Co-authored-by: Francisco Ryan Tolmasky I <tolmasky@gmail.com>

Author: JamieMagee