fix: patch vulnerabilities and bump outdated dependencies

[waldekmastykarz]

Summary

• carries forward every change from fix: patch vulnerabilities and bump outdated dependencies #7583
• upgrades adm-zip to 0.6.1, resolving the remaining high-severity vulnerability
• updates cooldown-eligible direct dependencies and keeps the existing transitive security overrides current
• leaves major-version updates for separate compatibility work

Security status

npm audit reports 0 vulnerabilities.

Not auto-applied

• @azure/msal-common 16.14.1 remains in the seven-day cooldown until September 22, 2026
• Zod 4.6.5 was reverted because it breaks the project's required 100% coverage instrumentation
• major updates remain for @azure/msal-node, @types/node, eslint-plugin-mocha, mocha, typescript, and several overrides

Validation

• npm run build
• npm test
• 16,106 tests passing
• 100% statement, branch, function, and line coverage

Supersedes #7583.

[waldekmastykarz]

Superseded by #7593, which carries forward all changes from this PR and adds the latest cooldown-eligible dependency security fixes.