fix(package-sources): adjust canary alarm timing to match hourly execution (#1813)

Adjusts the NPM.js canary alarm timing configuration to properly trigger
when the SLA is breached.

## Problem

The previous configuration would never trigger the alarm. With a 5
minute period and 4 evaluation periods, the alarm would evaluate over a
20 minute window. However, the canary runs once per hour, meaning
CloudWatch only receives metrics hourly. Since we treat missing data
points as not breaching, there would never be enough data points to
evaluate 4 periods before the next canary run, preventing the alarm from
ever triggering.

## Solution

The new configuration uses a 10 minute period with 1 evaluation period.
This triggers the alarm immediately when a canary run reports metrics
exceeding the SLA threshold. Since exceeding the SLA is itself a breach,
there's no need to wait for multiple data points. The 10 minute period
provides quick detection while accounting for potential drift in the
hourly canary schedule.

----

*By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license*

---------

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: mrgrain

src/__tests__/__snapshots__/construct-hub.test.ts.snap

@@ -606,8 +606,7 @@ export class NpmJs implements IPackageSource {
       packageName,
     });
 
-    const period = Duration.minutes(5);
-
+    const period = Duration.minutes(10); // we run canary once per hour, but not guaranteed exact times
     const alarm = new MathExpression({
       expression: 'MAX([mDwell, mTTC])',
       period,
@@ -622,7 +621,7 @@ export class NpmJs implements IPackageSource {
         `Runbook: ${RUNBOOK_URL}`,
       ].join('\n'),
       comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
-      evaluationPeriods: 4,
+      evaluationPeriods: 1,
       treatMissingData: TreatMissingData.NOT_BREACHING,
       threshold: visibilitySla.toSeconds(),
     });