fix: patch vulnerable transitive npm dependencies to close Dependabot alerts

[Serhioromano]

Summary

Fixes 9 open Dependabot security alerts on the default branch by upgrading
vulnerable transitive npm dependencies via overrides in package.json.

Alerts addressed

Alert	Package	Vulnerable → Fixed
#114	js-yaml	4.3.0 → 4.3.1
#97	linkify-it	3.0.3 → 5.0.2
#86	markdown-it	12.3.2 → 14.3.0
#80	serialize-javascript	6.0.2 → 7.1.0
#62	serialize-javascript	6.0.2 → 7.1.0
#60	minimatch	9.0.5 → 9.0.9
#58	minimatch	3.1.2 → 3.1.5
#39	glob	10.4.5 → 10.5.0
#7	xml2js	0.4.23 → 0.5.0

Changes

• Add overrides for js-yaml, eslint→minimatch, mocha→
  (glob, minimatch, serialize-javascript), vsce→
  (minimatch, markdown-it, xml2js)
• Pin minimatch ^3.1.3 as a devDependency so the nested vulnerable
  minimatch@3.1.2 under vsce → glob@7 is deduped to 3.1.5
• Remove unused glob/@types/glob devDependencies
• Regenerate package-lock.json

Verification

• npm run compile — passes
• npm run lint — only the pre-existing documented exceptions
• npm audit — all 9 alert packages at patched versions; only
  remaining item is low-severity diff (mocha transitive, no open alert)

Fixes #7 #39 #58 #60 #62 #80 #86 #97 #114