Set relative `exclude-newer` by default in `pixi init`

[VeckoTheGecko]

Problem description

I really like https://github.com/prefix-dev/pixi/releases/tag/v0.67.0 and its relative exclude-newer!

Personally (and, perhaps, naively) I think that a relative exclude-newer should be set by default on pixi init

[workspace]
authors = ["Vecko <36369090+VeckoTheGecko@users.noreply.github.com>"]
channels = ["conda-forge"]
name = "tmp"
platforms = ["osx-arm64"]
version = "0.1.0"
+exclude-newer = "7d" # only use packages that have been on channels for 7d

Giving people dependency cooldowns by default. In my experience, it's rare that people want to work at the bleeding edge for packages.

[pavelzw]

#5810

[pavelzw]

or do you mean always setting it no matter the configuration?

[VeckoTheGecko]

or do you mean always setting it no matter the configuration?

Yes - setting it when someone does pixi init so they by default have a safer project config. They can of course opt-out of it by removing that line.

I also think that having a short comment on the line would be nice as a bit of an explainer (e.g., # security pre-caution - only use packages that are at least 7d old)

[pavelzw]

this is only one of many safeguards you should take for supply chain security, see https://pixi.prefix.dev/latest/security.

i don't like bloating default configuration up with unnecessary things, especially if they can lead to unexpected behavior (for example not being able to download the latest packages on your private channels)

@ruben-arts @baszalmstra any opinions?