Update dependencies to resolve Dependabot alerts

[Sean McManus (sean-mcmanus)]

Summary

Update the Actions, Extension, and Themes dependency lockfiles to remediate all 28 currently open Dependabot alerts for Axios, Undici, ip-address, and brace-expansion. Preserve the existing manifest ranges and each brace-expansion major-version family.

• Axios: 1.18.1 → 1.20.0.
• Undici: 6.28.0 → 6.29.0.
• ip-address: 10.3.1 → 10.7.2.
• brace-expansion: 1.1.18 → 1.1.21, 2.1.4 → 2.1.7, and 5.0.9 → 5.0.12.

No manifest, release-version, or changelog changes.

This PR was investigated and created by GitHub Copilot (in VS Code). Any message starting with ✨Copilot: was sent by Copilot.

Validation

• All 28 alert ranges reproduce on the target baseline and exclude the updated lockfile versions.
• Clean Actions and Themes npm installs; frozen Extension Yarn install.
• Actions typecheck and 39 tests passed.
• Extension build, lint, 221 unit tests, 21 acquisition tests, and 2 lockfile tests passed.
• Themes audit: 0 vulnerabilities.
• Dependency-graph, formatting, and whitespace checks passed.

Existing audit finding

Actions still reports the unrelated, pre-existing braces advisory GHSA-vfj7-8cjw-p6xm through its Mocha/chokidar development dependency tree. That is a different package from brace-expansion and is unchanged by this PR.

[Copilot]

🟢 Approval recommended

The scoped lockfile updates preserve dependency compatibility, with no unresolved review findings.

Copilot wasn't able to review any files in this pull request.

Files not reviewed (2)

• .github/actions/package-lock.json: Generated file
• Themes/package-lock.json: Generated file