Npm package with broken tarballs leading to "(Permission denied)" error

Some npm packages have malformed tarballs (missing the +x file attr bit on directories) which don't play nicely with Bazel when they are extracted by the rules_js `NpmPackageExtract` action. See https://github.com/aspect-build/rules_js/issues/1637 for more details.

An example error from this issue:

```
WARNING: Remote Cache: /home/circleci/.cache/bazel/_bazel_circleci/a6e8cb0ce75ceb1ea1faa0cca0b0ae0d/execroot/figma/bazel-out/k8-fastbuild/bin/node_modules/.aspect_rules_js/pngjs@7.0.0/node_modules/pngjs/lib/format-normaliser.js (Permission denied)
ERROR: /home/circleci/foobar/BUILD.bazel:11:22: Extracting npm package pngjs@7.0.0 failed: IOException while logging spawn: /home/circleci/.cache/bazel/_bazel_circleci/a6e8cb0ce75ceb1ea1faa0cca0b0ae0d/execroot/figma/bazel-out/k8-fastbuild/bin/node_modules/.aspect_rules_js/pngjs@7.0.0/node_modules/pngjs/lib/bitmapper.js (Permission denied)
```

The work-around for these npm packages is to add `custom_postinstall` scripts for each with `chmod -R a+X *` or `chmod -R a+X * && ` to the `npm_translate_lock` repository rule / bzlmod extension.

This issue is here for users to share all of the package that this problem has been observed on where this work-around may be needed.

Start with the NpmPackageExtract action and the related rules_js issue 1637 to understand how malformed npm tarballs produce permission errors. Review the npm_translate_lock repository rule and bzlmod extension, then identify the affected packages and confirm that the documented custom_postinstall workaround resolves extraction.

Written by the indexing model from the issue text.