Upgrade allow-scripts; add preinstall-always-fail

This commit aligns this repo with the module template:

- Bump `@lavamoat/allow-scripts` to ^2.3.1
- Add `@lavamoat/preinstall-always-fail`, as it was being configured in
  the manifest, but not actually installed

package.json

@@ -32,7 +32,8 @@
     "gl-vec3": "1.0.3"
   },
   "devDependencies": {
-    "@lavamoat/allow-scripts": "^1.0.6",
+    "@lavamoat/allow-scripts": "^2.3.1",
+    "@lavamoat/preinstall-always-fail": "^1.0.0",
     "@metamask/auto-changelog": "^2.5.0",
     "@metamask/eslint-config": "^8.0.0",
     "@metamask/eslint-config-nodejs": "^8.0.0",