fix: resolve npm vulns and unbreak nix dev shell

[tembleking]

fast-uri and tmp had high-severity path traversal advisories; npm update + npm audit fix clears both (found 0 vulnerabilities).

The nixpkgs bump in just update dropped the nodePackages set, breaking the dev shell. Moved typescript-language-server and eslint to top-level pkgs so it builds again. Also added coreutils and gnused to the devshell: the cli-scanner recipes rely on GNU-only date -u -d and sed -i -E, which only worked by accident on hosts that already had GNU tools on PATH; now they are guaranteed for anyone entering nix develop.

Reworked the cli-scanner version tooling to track the 1-year support window instead of a single default. just update-cli-scanner / just update-oldest-cli-scanner substitute versions via doc-marker sentinels rather than a fragile global sed, so unrelated version-looking strings are no longer clobbered. Justfile recipes are now grouped and internal helpers marked private.

Also rolls in the routine just update bumps: cli-scanner 1.26 -> 1.27, pinned action SHAs (pinact), and flake.lock.

[mateobur]

Approving. Reviewed the version bump, the regenerated dist/, the nix change, and the dependency churn.

• cli-scanner 1.26.0 to 1.27.0 is consistent across src/infrastructure/sysdig/SysdigCliScannerConstants.ts, dist/index.js, action.yml, and the README. The only residual 1.26.0 strings are in tests/fixtures/vm/sarif-test.json, which is an unrelated commons-compress CVE fix version.
• dist/index.js matches src: the only first-party change is the version constant, and the rest of the churn is a genuine ncc rebuild tracking the undici 7.25.0 to 7.29.7 bump.
• The flake.nix dev shell fix is correct: typescript-language-server and eslint move to top-level buildInputs with no leftover nodePackages.* references, and flake.lock updates consistently.
• All dependency bumps are minor or patch, package.json untouched. The four pinned action SHAs are real 40-char pins matching their version comments.
• CI all green, which backs the 114/114 tests and 0 vulnerabilities claim.

Thanks!

[mateobur]

Solid maintenance PR. The action pin bumps are all SHA-pinned, and the oldest/newest scanner version markers plus the AGENTS.md documentation make the version-support workflow clear and consistent across action.yml, README, and dist. Since most of the diff is a regenerated dist bundle from the undici/npm update, please confirm dist/ was produced by a clean npm ci + build against the committed lockfile rather than edited by hand. Also double-check the nix dev-shell fix mentioned in the title landed, since I don't see nix files in the diff here.