deps: fix protobufjs + newly-expanded advisories (#251-259)

[laileni-aws]

Problem

A fresh batch of Dependabot alerts (medium/high) affects packages this repository already pins through overrides. Several advisories expanded after earlier patched versions were selected; most recently, #259 expanded the vulnerable fast-uri range through 3.1.3.

Solution

Bump the existing overrides to versions outside the current advisory ranges and regenerate the root lockfile. Alert #259 is folded into this existing PR because it affects the same fast-uri override and files as #257.

Alert(s)	Package	Bump	Severity
#251	protobufjs	7.6.3 → 7.6.5	medium
#252	brace-expansion (1.x)	1.1.13 → 1.1.16	high
#253	js-yaml (4.x)	4.2.0 → 4.3.0	high
#254	shell-quote	1.8.4 → 1.9.0	high
#255, #256	immutable	4.3.8 → 4.3.9	high
#257, #259	fast-uri	3.1.2 → 3.1.4	high
#258	linkify-it	5.0.1 → 5.0.2	high

Version-scoped overrides (pkg@major) are used where multiple majors coexist (brace-expansion, js-yaml).

Verification

• Root package-lock.json regeneration is byte-for-byte idempotent.
• npm ci --ignore-scripts passes; both generated streaming clients install and build successfully.
• npm ls fast-uri --all reports only 3.1.4 with no dependency problems.
• npm audit no longer reports fast-uri.
• npm run compile passes.
• npm run lint passes.

---

• Treat all work as PUBLIC. Private feature/x branches will not be squash-merged at release time.
• Your code changes must meet the guidelines in CONTRIBUTING.md.
• License: I confirm that my contribution is made under the terms of the Apache 2.0 license.

[laileni-aws]

✅ CI is fully green after syncing current main.

PR head a9e73a848 includes upstream main at 0c4d92ae1. Run 30592062672 completed with 16 passing jobs, 0 failures, and only the intentionally disabled lint-duplicate-code job skipped.

Both test macOS (stable) and test macOS (insiders) now pass with the @vscode/test-electron@3.1.0 fix inherited from main. The net PR delta remains scoped to package.json and package-lock.json security updates.