fix: patch vulnerabilities and bump outdated dependencies

[waldekmastykarz]

Summary

Patches all npm vulnerabilities and bumps outdated dependencies.

Vulnerabilities fixed

• adm-zip <0.6.0 (high) — Crafted ZIP file triggers 4GB memory allocation (bumped to 0.6.0)
• @opentelemetry/core <2.8.0 (moderate) — Unbounded memory allocation in W3C Baggage propagation (override)
• protobufjs <=7.6.2 (high) — Schema-derived names can shadow runtime-significant properties; DoS via unbounded Any expansion (override)
• serialize-javascript <=7.0.2 (high) — RCE via RegExp.flags; CPU exhaustion DoS (override)
• diff >=6.0.0 <8.0.3 (low) — DoS in parsePatch/applyPatch (override)
• uuid <11.1.1 (moderate) — Missing buffer bounds check (override scoped to adaptive-expressions)
• form-data (high) — CRLF injection via unescaped multipart field names (npm audit fix)
• js-yaml (moderate) — Quadratic-complexity DoS in merge key handling (npm audit fix)
• undici (high) — HTTP header injection, WebSocket DoS, response queue poisoning, Set-Cookie SameSite downgrade (npm audit fix)

Direct dependency bumps

Package	From	To
adm-zip	^0.5.17	^0.6.0
applicationinsights	^3.14.0	^3.15.1
@azure/msal-common	^16.6.2	^16.11.1
@azure/msal-node	^5.2.2	^5.4.0
@inquirer/confirm	^6.1.0	^6.1.1
@inquirer/input	^5.1.0	^5.1.2
@inquirer/select	^5.2.0	^5.2.1
axios	^1.16.1	^1.18.1
csv-stringify	^6.7.0	^6.8.1
semver	^7.8.1	^7.8.5
@types/node	^24.12.4	^24.13.3
@typescript-eslint/eslint-plugin	^8.60.0	^8.63.0
@typescript-eslint/parser	^8.60.1	^8.63.0
eslint	^10.4.0	^10.7.0
globals	^17.6.0	^17.7.0
tsc-watch	^7.2.0	^7.2.1

Overrides added/updated

Package	Override
@opentelemetry/core	>=2.8.0
protobufjs	>=7.6.5
serialize-javascript	>=7.0.7
diff	>=8.0.3
uuid (in adaptive-expressions)	>=11.1.1

Remaining (no fix available)

• fast-xml-parser <5.7.0 (moderate) — transitive via adaptive-expressions; fix requires major version 5.x which would break the parent package. Waiting on upstream.

Verification

• npm run build: ✅
• npm run lint: ✅
• npm test: ✅ (15938 passing)

Supersedes #7448 (includes all its changes plus adm-zip 0.6.0, msal updates, and additional override fixes).