fix: bump dependencies and resolve npm audit vulnerabilities

[dianaKhortiuk-frontegg]

Summary

Regenerates the stale package-lock.json and bumps dependencies so npm audit reports 0 vulnerabilities (down from 51). The stale lockfile (still pinning axios 1.15.0, express 4.21.2, and a bundled npm@9.9.4) was the root cause of the inflated audit count.

Changes

Production dependencies (shipped to consumers + the only tier the CI audit-ci gate enforces):

• axios ^1.15.0 → ^1.18.1 — resolves ~20 high-severity CVEs (SSRF, prototype pollution, ReDoS, credential leakage). The one production vulnerability.
• winston ^3.18.3 → ^3.19.0
• @frontegg/entitlements-javascript-commons ^1.1.3 → ^1.2.1

Overrides (patch transitive advisories):

• form-data ^4.0.6 — CRLF injection; axios pulled a vulnerable 4.0.5
• tmp ^0.2.5 → ^0.2.7 — path traversal; the old ^0.2.5 override still resolved to vulnerable 0.2.5 (advisory requires ≥0.2.6)

Dev dependencies (audit noise; not CI-gated since audit-ci.jsonc has skip-dev: true, cleaned up for hygiene):

• express ^4.19.2 → ^4.22.2
• jest-junit ^14.0.1 → ^17.0.0
• semantic-release ^21.0.5 → ^25.0.7 — drops the bundled npm@9.9.4 that accounted for ~30 of the transitive advisories

Docs:

• Added a Security section to the README (patched-dependency posture, CI vulnerability check, responsible disclosure to security@frontegg.com). docs/CHANGELOG.md is intentionally untouched — it's auto-generated by semantic-release at release time.

Verification

• npm audit: 0 vulnerabilities (full tree and --omit=dev)
• Build (tsc): ✅
• Tests: ✅ 228 passed / 28 suites
• Lint: ✅ (verified with plugin resolution pinned to the checkout)

🤖 Generated with Claude Code