fix: run npm audit fix to resolve 22 vulnerabilities

[cabljac]

Summary

Runs npm audit fix to resolve 22 of 47 vulnerabilities via non-breaking dependency updates to package-lock.json.

Fixes high/critical vulnerabilities in path-to-regexp, express, picomatch, qs, body-parser, node-forge, underscore, ajv, flatted, minimatch, yaml, and others.

Supersedes

This PR covers the security fixes from the following dependabot PRs:

• Bump path-to-regexp and express #1851 — Bump path-to-regexp and express
• Bump picomatch #1849 — Bump picomatch
• Bump flatted from 3.3.3 to 3.4.2 #1847 — Bump flatted from 3.3.3 to 3.4.2

Those PRs can be closed if this one is merged.

Remaining vulnerabilities (25)

The remaining 25 vulnerabilities all require breaking major version bumps (e.g. firebase-admin, mocha, @microsoft/api-extractor) or have no fix available (elliptic), and were skipped by npm audit fix.

[gemini-code-assist]

Code Review

This pull request updates package-lock.json, bumping several dependencies including @apollo/server, @google-cloud/storage, @microsoft/api-extractor, firebase-admin, and express. These updates also trigger major version jumps for transitive dependencies such as fs-extra, minimatch, and google-auth-library. I have no feedback to provide.