chore(CP-12104): patch critical and high library dependencies

[tannerhelton]

Summary

Patch available dependency paths using scoped npm overrides for serialize-javascript, tar, tmp, and image-size 1.2.1.

Remaining findings: image-size 1.2.1 is still affected by GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq, with no published fixed version in the upstream advisories. The requested install-hook source patch was explicitly declined; these two findings are left open. This PR does not add an installation hook.

Scope

Update the dependency paths associated with the critical/high library findings returned by pup from the Datadog devops organization.

• @babel/plugin-transform-modules-systemjs — GHSA-fv7c-fp4j-7gwp
• flatted — GHSA-rf6f-7fwh-wjgh
• form-data — GHSA-fjxv-7rqg-78g4
• glob — GHSA-5j98-mcp5-4vw2
• image-size — GHSA-5p2g-fcmc-qvqq
• image-size — GHSA-m5qc-5hw7-8vg7
• image-size — GHSA-w3rx-r6r6-pgpr
• js-yaml — GHSA-5p4m-2wfm-xmqj
• lodash — GHSA-r5fr-rjxr-66jc
• minimatch — GHSA-3ppc-4f35-3m26
• node-forge — GHSA-2328-f5f3-gj25
• node-forge — GHSA-5gfm-wpxj-wjgq
• serialize-javascript — GHSA-5c6j-r48x-rmvq
• shell-quote — GHSA-w7jw-789q-3m8p
• tar — GHSA-23hp-3jrh-7fpw
• tar — GHSA-8x88-c5mf-7j5w
• tar — GHSA-r6q2-hw4h-h46w
• tmp — GHSA-ph9p-34f9-6g65

Out of scope

Deployment and release promotion.

Verification

• npm install, TypeScript build and lint passed.
• All 7 plugin tests passed.
• Advisory range comparison: 19 Datadog finding rows cleared; the two image-size findings above remain.

The resolved lockfile was compared against the upstream advisory affected ranges for these Datadog findings. Datadog may continue to show the base-branch findings until this change is merged and rescanned.

UI evidence

No visual changes.

Related work

CP-12104 tracks the cross-repository remediation.