bump token-group and token-js

[buffalojoec]

Bump & publish @solana/spl-token-group version 0.0.5 to include any recent changes to dependencies.

Then bump & publish @solana/spl-token version 0.4.8 to include the newer Token Group JS, eliminating the dependency on the deprecated version.

Closes #6958

SPL JS Postbuild Step

In our repository, we build and publish packages using pnpm version 8.14.3 (see workspace package.json). There are a few ways you can configure a matching pnpm version locally, but I use the following command, since my global version is 9.5.0.

npx [email protected] <command>

When using the proper version of pnpm and - after installing all packages - running the build step from the workspace root (ie., npx [email protected] run build), the postbuild step that configures the CJS output is successfully run by Turbo.

However, if you run this command within any package's local directory, for example token/js, Turbo won't be used, and instead pnpm is used directly to call the script in that package's package.json. In this situation, the post-build step is not run.

pnpm version 9 includes pre- and post-build scripts by default, so whenever SPL's version of pnpm is upgraded we will no longer need to worry about this crucial pre-publish step being missed. However, as a precaution, and to solve the issue for pnpm version 8, I've added the following configuration in a .npmrc file:

enable-pre-post-scripts=true

See the discussion on the pnpm repository or this blog for more information.