LTS-3294: add supply-chain hardened .npmrc

Adds the .npmrc required by the weekly SC-12282 supply-chain audit.
Enables strict-ssl, save-exact, audit-level=high, legacy-peer-deps=false.

ignore-scripts and engine-strict are deferred (documented in-file):
ignore-scripts would disable this repo's `postinstall: npm update
browserstack-node-sdk`; engine-strict would break `npm install` for
customers on varied Node versions. access=restricted omitted (public repo).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: amitsi-bs

.npmrc

@@ -0,0 +1,19 @@
+# Supply-chain hardening directives (SC-12282 / LTS-3294)
+# See: https://browserstack.atlassian.net/wiki/spaces/ENG/pages/6091571922/Supply+Chain+Security+Enhancements+Tech+Spec
+#
+# access=restricted is intentionally OMITTED — this is a public, customer-facing
+# sample repository, not a published private package.
+#
+# ignore-scripts=true is intentionally DEFERRED. This repo ships its own
+# postinstall (`npm update browserstack-node-sdk`) so the sample always runs the
+# latest SDK; enabling ignore-scripts would silently disable it. Re-enable once
+# the sample pins the SDK and drops the postinstall.
+#
+# engine-strict=true is intentionally DEFERRED. Customers clone and run this
+# sample on a wide range of Node versions; hard EBADENGINE enforcement on
+# transitive deps would break `npm install` for them. Kept as a warning.
+
+strict-ssl=true
+save-exact=true
+audit-level=high
+legacy-peer-deps=false