Fix dependency CVEs in Cloudflare tools, VSCode extension build, and docs pipeline

[highbyte]

Summary

Resolves all 30 open Dependabot alerts on master (11 high, 19 moderate) — every alert is in build/dev tooling; no shipped .NET code is affected. The alerts collapse to 6 packages:

Package	Fix	How
undici, sharp (via miniflare/wrangler)	7.29.0 / 0.35.0	npm update (wrangler within ^4) + @cloudflare/vitest-pool-workers 0.12 → 0.21
postcss, nanoid	8.5.23 / patched	npm update / npm audit fix
brace-expansion, undici (via @vscode/vsce)	1.1.16 / 7.29.0	npm audit fix in vscode-extension
pymdown-extensions	11.0.1	pip-compile --upgrade-package in requirements-docs.txt

The @cloudflare/vitest-pool-workers 0.21 bump required vitest 3 → 4 and the new plugin-style config (cloudflareTest + defineConfig replaces defineWorkersConfig) in cors-download-proxy and swiftlink-bridge — migrated per the package's official vitest-v3-to-v4 codemod pattern.

Verification

• npm audit: 0 vulnerabilities in all four npm projects.
• cors-download-proxy: 20/20 tests pass on vitest 4.
• swiftlink-bridge: 9/9 tests pass on vitest 4.
• app-sec-headers: wrangler deploy --dry-run succeeds on updated wrangler.
• VSCode extension: tsc compile + vsce package succeed (no changelog entry — dev-time lockfile only, no user-visible change to the published extension).
• Docs: mkdocs build --strict succeeds with pymdown-extensions 11.0.1.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud