chore: add private:true to prevent npm publish (#4384) (#144)

* chore: add private:true to prevent npm publish (#4384)

This service should only publish Docker images to hub.docker.com,
not npm packages to npmjs.com. Adding "private": true causes the
CircleCI orb's check_npm_private gate to skip the publish_npm job.

Refs: mojaloop/project#4384

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update node 22.22.1, orb 1.1.19, fix npm audit overrides

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore: update dependencies and fix vulnerabilities

Updated npm overrides to latest patch versions:
- fast-xml-parser: 5.5.7 → 5.5.8
- jsonpath-plus: 10.3.0 → 10.4.0
- qs: 6.14.2 → 6.15.0
- validator: 13.15.22 → 13.15.26

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Juan Correa <gibaros@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: gibaros

.circleci/config.yml

@@ -1,7 +1,7 @@
 version: 2.1
 setup: true
 orbs:
-  build: mojaloop/build@1.1.16
+  build: mojaloop/build@1.1.19
 workflows:
   setup:
     jobs:

.nvmrc

@@ -1 +1 @@
-22.22.0
+22.22.1

audit-ci.jsonc

@@ -4,7 +4,6 @@
   // Only use one of ["low": true, "moderate": true, "high": true, "critical": true]
   "moderate": true,
   "allowlist": [ // NOTE: Please add as much information as possible to any items added to the allowList
-    "GHSA-2g4f-4pwh-qvx6", // ajv ReDoS - no fix available in 8.x line, unfixable via override
-    "GHSA-3ppc-4f35-3m26" // minimatch ReDoS - fix requires v10 (major version break), unfixable via override
+    "GHSA-2g4f-4pwh-qvx6" // ajv ReDoS - transitive via @mojaloop/inter-scheme-proxy-cache-lib and ml-testing-toolkit-shared-lib, unfixable via override
   ]
 }