Unpin npm but specify as packageManager. This is another attempt to fix dependabot issues.

Author: tdonohue

package-lock.json

@@ -232,7 +232,7 @@
     "webpack-cli": "^6.0.1"
   },
   "engines": {
-    "node": ">=20.0.0 <25.0.0",
-    "npm": "^10"
-  }
+    "node": ">=20.0.0 <25.0.0"
+  },
+  "packageManager": "[email protected]"
 }