feat: update libs for limited perms, fix and speed up Dockerfile build, fix wrong imports, firefox patches and policies, NY TZ

[MQ37]

This PR updates the node packages before enabling the limited permissions, just in case - encountered issue with bad cheerio related type imports and then with the Dockerfile build process.

Tested on my personal account

[jirispilka]

Should we use similar dockerfile as in website-content-crawler: https://github.com/apify/store-website-content-crawler/blob/main/.actor/Dockerfile

Ideally I would keep it as close as possible.

[matyascimbulka]

Looks good, pre-approving. There are some lint errors that should be fixed before merging.

[MQ37]

Should we use similar dockerfile as in website-content-crawler: https://github.com/apify/store-website-content-crawler/blob/main/.actor/Dockerfile

Ideally I would keep it as close as possible.

Honestly I would not do that, we can customize the Dockerfile to server our needs and these are different to WCC. This change sped up the build times from ~ 3 minutes to under 1 minute. Also when I saw their build process depending on some random Russian API to get current time I would not also do that 😅 (see https://github.com/apify/store-website-content-crawler/blob/1159fd27675a61639b2a8191e167c6d2e0bbf237/.actor/Dockerfile#L22C1-L23C73). Sometimes it's better to "reinvent" the wheel than to stick to the standardized solution that you just blindly copy, even if they work - they will break one day and fixing something that you did not write sucks, for example the langchain-apify build github workflow, we are just using shared one and it was migrated to uv from poetry without us knowing and it broke the pipeline, if we used our own it would be fine. So I am strongly against this.

[jirispilka]

Build time is not that important when running in prod.

I never said we should copy it blindly. Let me explain my reasoning: the tooling team is actively working on this so why not learn from their Dockerfile and reuse what makes sense for us.

For example: TZ settings, patches (if needed), policies, etc.

[MQ37]

Build time is not that important when running in prod.

I never said we should copy it blindly. Let me explain my reasoning: the tooling team is actively working on this so why not learn from their Dockerfile and reuse what makes sense for us.

For example: TZ settings, patches (if needed), policies, etc.

Makes sense, will implement the relevant stuff from the WCC dockerfile 👍