fix(security): consolidate Dependabot alerts and dependency updates - #417

Address all 4 review comments on PR #414:

- Convert previously-unscoped overrides (serialize-javascript, flatted,
  markdown-it, qs, underscore, diff) to version-scoped form. Each now only
  applies to versions in the vulnerable range, eliminating the risk of
  forcing major-version upgrades on out-of-scope consumers.

- Bump brace-expansion v1 override target from ^1.1.13 -> ^1.1.14 (and
  trigger range to <1.1.14) so the override deterministically lands on
  the version the lockfile already resolved.

- Bump minimatch v3 override target from ^3.1.4 -> ^3.1.5 (and trigger
  range to <3.1.5) for the same deterministic-resolution reason.

- Replace blanket diff ^8.0.3 with two scoped ranges:
    diff@>=5.0.0 <5.2.2 -> ^5.2.2  (patches v5 line in place)
    diff@>=6.0.0 <8.0.3 -> ^8.0.3  (patches v6/v7 line, matches what
                                    mocha 11.7.5 already pulls in)

Validation:
- npm audit reports 0 vulnerabilities
- All 14 originally-flagged alerts remain resolved
- npm run compile, lint, pack all clean

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The version-scoped `diff@>=6.0.0 <8.0.3 -> ^8.0.3` override caused
`npm ci` to fail under npm 10.8.2 (used by CI) with:

  npm error EUSAGE
  npm error `npm ci` can only install packages when your package.json
  npm error and package-lock.json or npm-shrinkwrap.json are in sync.
  npm error Missing: diff@7.0.0 from lock file

This is an npm 10 limitation: its `npm ci` lockfile validator does not
fully consult version-scoped overrides when determining whether the
lockfile satisfies a consumer's declared range (mocha 11.7.5 declares
`diff: ^7.0.0` but the override redirects to 8.0.4).

Switching to a nested override under mocha — matching upstream PR
microsoft/PSDocs-vscode#539 — is npm-10-compatible AND even more
narrowly scoped than the version-range form (only mocha's diff
consumer is affected). The v5 diff CVE range is no longer in the
tree (mocha now uses ^7.0.0, not ^5.0.0), so a separate v5 patch is
unnecessary.

Also regenerated the lockfile with npm 10.8.2 to ensure parity with
the CI runtime.

Validation:
- npm install (npm 10.8.2) -> 0 vulnerabilities
- npm ci (npm 10.8.2) -> succeeds, 0 vulnerabilities
- npm run compile, lint, pack all clean
- diff still resolves to 8.0.4 (patched)
- All 14 originally-flagged alerts remain resolved

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Both workflows failed at startup (0s) on every push to main because of
invalid workflow-file config, leaving main with a persistent red status.

- codeql.yml: the `paths` input to codeql-action/init was a YAML sequence,
  but the action input must be a scalar string. Convert to a scalar so the
  `with:` block is valid.
- vscode-ci.yml: the publish step used the `secrets` context in an `if:`
  conditional, which is not allowed. Reference `env.VSCE_PAT` instead (the
  step already maps the secret into env).

Validated with actionlint: no syntax/expression startup errors remain.

Fixes #415

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Enabling the previously-broken codeql.yml and vscode-ci.yml workflows
surfaced two pre-existing failures that those startup errors had masked.

PSRule MSFT.OSS.License (codeql.yml `oss` job, repo-root scan):
- Add a root ps-rule.yaml so the monorepo-wide scan ignores generated
  resource designers (*.Designer.cs) and the vendored packages/psdocs and
  packages/vscode-extension subtrees, mirroring the per-package configs.
- build.ps1 is ignored because it needs a shebang on line 1 (for the
  documented `./build.ps1`), which is incompatible with the rule requiring
  the license header to be the first line.
- Add the standard license header to scripts/extract-release-notes.ps1.

vscode-ci.yml test jobs (TypeError: glob is not a function):
- package.json was bumped to glob ^11, whose callback API was removed in
  v9. Update the mocha bootstrap (src/test/suite/index.ts) to use the
  promise-based glob API. Verified with `npm ci && npm run compile`.

Verified the OSS scan locally with PSRule 2.9.0 + MSFT.OSS 1.1.0: 0 failures.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The Windows test jobs failed with "Failed to get VS Code archive location".
The deprecated vscode-test@1.6.1 hardcodes the legacy `win32-archive`
(32-bit) platform, which modern VS Code (1.126.0) no longer publishes, so
the download URL could not be resolved on Windows (Linux/macOS were
unaffected as their platform strings still exist).

Migrate the integration-test harness to the maintained successor
@vscode/test-electron ^2.5.2, which resolves `win32-x64-archive`. Pinned to
the 2.x line because 3.x requires Node >=22 while CI runs Node 20. The
runTests API is unchanged.

Verified locally: version resolves and VS Code downloads successfully
(the prior failure point); compile passes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

After the test harness could download VS Code again, the macOS test job
failed at launch: "IPC handle ... is longer than 103 chars" /
"listen EINVAL". VS Code's default user-data-dir under .vscode-test
produces a Unix domain socket path that exceeds the macOS 103-char
sun_path limit.

Launch the test instance with a short --user-data-dir under the OS temp
directory. No-op on Windows (named pipes) and Linux (longer limit, shorter
path), but unblocks macOS.

Verified locally on macOS: VS Code launches, the extension host starts, and
mocha completes successfully (exit 0).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 89e0a8f4-17aa-4419-9705-4b96e4494c53

- Bump @vscode/vsce ^3.7.1 -> ^4.0.0 (drops vulnerable markdown-it,
  secretlint/globby/fast-glob/micromatch/braces chain)
- Bump mocha ^11.1.0 -> ^11.7.5 (chokidar/braces chain)
- Bump @vscode/test-electron ^2.5.2 -> ^3.1.0 (supports renamed macOS
  'Code' binary in current VS Code)
- Regenerate lockfile from scratch so transitives resolve to patched
  versions; replace broad overrides with mocha-scoped diff and
  serialize-javascript overrides
- npm audit: 0 vulnerabilities

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 89e0a8f4-17aa-4419-9705-4b96e4494c53

- actions/checkout v4.2.2 -> v7.0.1
- actions/upload-artifact v4.6.2 -> v7.0.2
- actions/download-artifact v4.2.1 -> v8.0.2
- actions/setup-dotnet v4.3.1 -> v6.0.0
- actions/setup-node v4.4.0 -> v7.1.0
- actions/setup-python v5.4.0 -> v7.0.0
- actions/stale v9.1.0 -> v11.0.0
- github/codeql-action v3.28.12 -> v4.39.1
- Node.js 20.x (EOL) -> 22.x (required by @vscode/vsce 4 / test-electron 3)
- Docs Python 3.9 (EOL, dropped by setup-python v7) -> 3.12

Supersedes #389, #394, #404, #406, #365.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 89e0a8f4-17aa-4419-9705-4b96e4494c53

- PSDocs.Tests / PSDocs.Benchmark: pin patched transitive versions
  System.Data.SqlClient 4.8.6 (GHSA-98g6-xh36-x2p7),
  System.Formats.Asn1 8.0.1 (GHSA-447r-wph3-92pm),
  System.Net.Http 4.3.4 (GHSA-7jgj-8wvc-jh57, benchmark),
  System.Text.RegularExpressions 4.3.1 (GHSA-cmhx-cq75-c4mj, benchmark)
- PSDocs.Azure: Microsoft.CodeAnalysis.NetAnalyzers 7.0.4 -> 9.0.0
  (aligns with PSDocs; supersedes #367)
- PSDocs.Azure: Microsoft.SourceLink.GitHub 1.1.1 -> 10.0.402
  (supersedes #304; skips 8.0.0 which pulls Microsoft.Build.Tasks.Git
  8.0.0 affected by GHSA-23fw-v26w-5fgq)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 89e0a8f4-17aa-4419-9705-4b96e4494c53

- mkdocs-material 9.7.6 -> 9.7.7 (PYSEC-2026-3864)
- pymdown-extensions 10.21.2 -> 12.3 (PYSEC-2026-2999, PYSEC-2026-3609,
  PYSEC-2026-3654)
- pygments 2.20.0 -> 2.21.0, mike 2.1.3 -> 2.2.0,
  mkdocs-redirects 1.2.2 -> 1.2.3

Supersedes #376.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 89e0a8f4-17aa-4419-9705-4b96e4494c53

- Point NuGet updates at the actual project directories under packages/
- Add npm updates for packages/vscode-extension (previously untracked)
- Group updates per ecosystem and move version updates to weekly
- Drop deprecated 'reviewers' key; reviewers come from CODEOWNERS

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 89e0a8f4-17aa-4419-9705-4b96e4494c53