Disable npm lifecycle scripts and npx for security

- Add npm/yarn ignore-scripts config to Dockerfile
- Disable npx with a stub that shows an error message
- Add --ignore-scripts flag to npm install

Related to PDE-128

Co-authored-by: Ona <no-reply@ona.com>

Author: jespino

gitpod/gitpod.Dockerfile

@@ -1,4 +1,13 @@
 FROM gitpod/workspace-full:latest
 
+# Disable npm lifecycle scripts and npx for security
+RUN npm config set ignore-scripts true --location=user && \
+    echo 'ignore-scripts true' >> ~/.yarnrc && \
+    rm -f /usr/bin/npx /usr/local/bin/npx && \
+    echo '#!/bin/sh' > /usr/local/bin/npx && \
+    echo 'echo "npx is disabled for security reasons. Use explicit package installation instead." >&2' >> /usr/local/bin/npx && \
+    echo 'exit 1' >> /usr/local/bin/npx && \
+    chmod +x /usr/local/bin/npx
+
 # Cache firebase
-RUN npm install --global npm firebase firebase-tools
+RUN npm install --global --ignore-scripts npm firebase firebase-tools