chore: fix dependency vulnerabilities (28 -> 8, all highs resolved) (#1411)

Resolves all 9 high-severity npm-audit findings plus Dependabot alerts
across transitive dev/runtime deps. Strategy:

- Bump existing overrides to patched versions: basic-ftp ^6.0.1,
  serialize-javascript ^7.0.5, postcss ^8.5.15, qs ^6.15.2
- New flat overrides (single-major, single-instance, safe): tmp ^0.2.7,
  undici ^6.24.0, defu ^6.1.7, flatted ^3.4.2, form-data ^2.5.6,
  ip-address ^10.2.0, js-yaml ^4.2.0, lodash ^4.18.1
- Scoped overrides to avoid forcing inBundle siblings: tinyglobby>picomatch
  ^4.0.4 (leaves inBundle picomatch 2.3.2), tfx-cli>uuid ^13.0.1 (leaves
  inBundle uuid 3.4.0 under azure-pipelines-task-lib)
- Direct dep bump: tar ^7.5.16
- Lock-file patch (Strategy C) for follow-redirects 1.15.11 -> 1.16.0;
  overrides cannot reach it (inBundle via bundled cli-wrapper subtree)

Remaining 8 (down from 28) are documented accepted-risk/deferred:
- 6 low: elliptic chain (GHSA-848j-6mx2-7j84, dev-only, no patch)
- 2 moderate: uuid 3.4.0 bundled in azure-pipelines-task-lib (requires
  uuid ^3.0.1) -> needs upstream fix; cannot override a bundled subtree

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jbujula

package-lock.json

@@ -64,7 +64,7 @@
     "sinon": "^16.1.0",
     "sinon-chai": "^3.6.0",
     "sync-request": "^6.1.0",
-    "tar": "^7.5.11",
+    "tar": "^7.5.16",
     "tfx-cli": "^0.23.1",
     "ts-loader": "^9.5.1",
     "ts-node": "^10.9.2",
@@ -79,16 +79,30 @@
     "@types/node": "~24.3.0",
     "nanoid": "3.3.11",
     "electron-to-chromium": "1.5.250",
-    "basic-ftp": "^5.2.0",
-    "serialize-javascript": "^7.0.3",
-    "postcss": "^8.4.31",
-    "qs": "^6.14.2",
+    "basic-ftp": "^6.0.1",
+    "serialize-javascript": "^7.0.5",
+    "postcss": "^8.5.15",
+    "qs": "^6.15.2",
     "diff": "^5.2.0",
     "ajv": "^6.12.6",
     "underscore": "^1.13.8",
     "bn.js": "^5.2.3",
+    "tmp": "^0.2.7",
+    "undici": "^6.24.0",
+    "defu": "^6.1.7",
+    "flatted": "^3.4.2",
+    "form-data": "^2.5.6",
+    "ip-address": "^10.2.0",
+    "js-yaml": "^4.2.0",
+    "lodash": "^4.18.1",
     "minimatch": {
       "brace-expansion": "^5.0.6"
+    },
+    "tinyglobby": {
+      "picomatch": "^4.0.4"
+    },
+    "tfx-cli": {
+      "uuid": "^13.0.1"
     }
   },
   "dependencies": {