security: fix non-breaking medium/low vulnerabilities

- Applied npm audit fix (non-breaking changes only)
- Fixed 7 vulnerabilities via transitive dependency updates
- 4 moderate vulnerabilities remain (require breaking mocha v11 upgrade):
  * js-yaml prototype pollution (GHSA-mh29-5h37-fv8m)
  * nanoid predictable results (GHSA-mwcw-c2x4-8c55)
  * serialize-javascript XSS (GHSA-76p7-773f-r4q5)
  * Related mocha dependencies
- Tests still pass with current changes

Author: mgwoj