Pin npm 11.18.0 in Docker builds

[ar2rsawseen]

What changed

• Replace the floating npm@10 install with exact npm@11.18.0.
• Apply the pin consistently to the Debian and CentOS API/frontend Dockerfiles.

Why

Master's Docker images use Node 20, which supports npm 11.18.0. The current npm@10 range resolves to npm 10.9.8, whose bundled dependency tree still reports known vulnerabilities, including the critical node-tar advisory.

npm 11.18.0:

• supports Node ^20.17.0 || >=22.9.0;
• includes patched tar@7.5.19 and sigstore@4.1.1;
• returned zero known vulnerabilities in a clean audit comparison performed on 2026-07-23.

Using an exact version also makes the Docker build reproducible and prevents a future npm major release from being selected unexpectedly.

Impact

The Docker images retain Node 20 while moving their package manager to the latest compatible, audited npm version.

Validation

• git diff --check
• docker buildx build --check for all four changed Dockerfiles
• Installed and ran npm 11.18.0 on node:iron-bookworm-slim:
  • Node v20.20.2
  • npm 11.18.0

Companion release branch PR: #7840

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.