feat: add rule to catch npx usage in JS/TS/YAML

[NicholasEllul]

This pull request expands on the existing rules that flags the usage of npx in shell / package.json such that we identify npx usage in a wider range of contexts.

---

Note

Introduces broader detection of npx usage to improve supply chain risk coverage.

• Adds npx-usage-js (JS/TS) and npx-usage-yml (YAML) rules with patterns to flag npx in strings and run commands
• Tweaks existing npx-usage-json and npx-usage-shell rule files (quote style/whitespace) without changing detection logic
• Adds tests: npx-usage-js.test.js, npx-usage-js.test.ts, and npx-usage-yml.test.yml covering flagged and allowed cases

^{Written by Cursor Bugbot for commit abf5be6. This will update automatically on new commits. Configure here.}