Add minimal age gate for yarn packages (1w)

[jubeira]

Description

Whenever we update the lockfile, only bring in packages that have been released at least 1 week ago.
This should prevent (some?) supply chain attacks in case we're unlucky enough to update something while one of them is ongoing; they are usually discovered within hours / a day.

See yarnpkg/berry#6899 for reference.

Type of change

• Bug fix
• New feature
• Breaking change
• Dependency changes
• Code refactor / cleanup
• Documentation or wording changes
• Other

Checklist:

• The diff is legible and has no extraneous changes
• N/A Complex code has been commented, including external interfaces
• N/A Tests are included for all code paths
• The base branch is either master, or there's a description of how to merge

Issue Resolution

N/A

[EndymionJkb]

Great idea! We should put this on everything then. (Assuming CI failures are just intermittent.)