chore(.npmrc): ignore scripts

[Fdawgs]

After the recent supply chain attacks that use install scripts, we should enable this everywhere.

This was already enabled in the main fastify repo as part of fastify/fastify#6108.
If this is approved and merged then I will do a batch of PRs to the rest of the repos.

Checklist

• run npm run test && npm run benchmark --if-present
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

[mcollina]

lgtm

In a lot of repositories we use @fastify/pre-commit to set up the pre-commit script (not sure here). We should ideally white-list that.

[Fdawgs]

lgtm

In a lot of repositories we use @fastify/pre-commit to set up the pre-commit script (not sure here). We should ideally white-list that.

Is there a way to whitelist? Only thing I can thing of is running npm rebuild @fastify/pre-commit

If not, maybe we just need to remove @fastify/pre-commit? From looking at where it is used it runs lint and test, both of which the CI workflows run anyway.

[jsumners]

We should ideally white-list that.

The only way I see to enable that is https://github.com/LavaMoat/LavaMoat/tree/main/packages/allow-scripts.

I'm not so convinced the pre-commit script is worth it any longer. In my view, it was meant to assure a commit is "clean" before it gets suggested as a change in a PR. But a lot of people just clone, edit, and PR. They never even install dependencies and simply rely on CI to do all of the work. Personally, I end up skipping it more often than not with -n because it's an annoying step that probably won't work due to all of the not-JavaScript stuff.

[mcollina]

lgtm