fix: bump undici, fast-xml-parser, and brace-expansion to resolve CVEs

[reyhankoyun]

Summary

Resolves all open Dependabot security alerts by updating vulnerable transitive dependencies:

• undici (High): WebSocket DoS via fragment count bypass, HTTP header injection, SameSite downgrade, response queue poisoning
• fast-xml-parser (Moderate): XML Comment and CDATA injection via unescaped delimiters

Changes

• Updated package-lock.json with patched versions
• Rebuilt dist/ bundle to include patched runtime dependencies

Testing

• npm audit reports 0 vulnerabilities
• All 55 tests pass with 100% coverage

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (42007fc) to head (eab3c4f).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #317   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            4         4           
  Lines          164       164           
  Branches        38        40    +2     
=========================================
  Hits           164       164           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[simonmarty]

It looks like the brace-expansion is being brought by eslintrc and jest. Maybe we can wait for them to put out a patch release instead of doing an override? I feel like this override is something we're going to end up forgetting about in the future.

Plus they're dev-dependencies so that has me a little less worried than the other CVEs.

[i-am-SR]

Could you update the PR description (changes) so it accurately reflects what shipped before merging?