Yarn 4.10+ - Support `npmMinimalAgeGate` and `npmPreapprovedPackages`

[yeikel]

Is there an existing issue for this?

• I have searched the existing issues

Feature description

npmMinimalAgeGate

Minimum age of a package version according to the publish date on the npm registry to be considered for installation.

If a package version is newer than the minimal age gate, it will not be considered for installation. This can be used to reduce the likelihood of installing compromised packages, or to avoid relying on packages that could still be unpublished (e.g. the npm registry has specific rules for packages less than 3 days old).

npmPreapprovedPackages

Array of package descriptors or package name glob patterns to exclude from all of the package gates.

If a package descriptor or name matches the specified pattern, it will not be considered when evaluating any of the package gates.

Dependabot should read the npmMinimalAgeGate from .yarnrc.yml configuration and convert it internally to the equivalent cooldown value. This would allow projects to keep their existing Yarn onfiguration without manual translation while ensuring consistent update behavior across ecosystems.

Additional context

Same as #13405 but for Yarn