doc: add section about using npx with permission model

[RafaelGSS]

cc: @wraithgar

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg

[wraithgar]

@RafaelGSS and I tested this locally w/ both npx and npm exec. This is the preferred way to set these flags, as it works in virtually all existing versions of npm already and does exactly what we need. Future changes to these flags only requires updating the flags you set via this parameter, and no changes to npm would be needed.

[AugustinMauroy]

maybe add link to npx docs for people not 100% aware of what is npx

https://docs.npmjs.com/cli/v8/commands/npx