fix(deps): resolve critical proxy-addr, high adm-zip, and fast-uri Snyk findings

- Bump adm-zip 0.6.0 -> 0.6.1 (Snyk high: symlink attack, decompression
  amplification, excessive memory allocation)
- Add proxy-addr override ^2.0.8 (Snyk critical: user impersonation via
  express's still-pinned proxy-addr ~2.0.7; express itself has not yet
  bumped its declared range)
- Raise fast-uri override floor ^3.1.7 -> ^3.1.8 (Snyk medium: improper
  case-sensitivity handling; the existing override's floor predated the fix)
- Retire obsolete lodash, form-data, and js-yaml overrides: each now
  resolves at or above its former pinned floor without the override
  (verified via npm ls ... and a clean Snyk re-scan before/after removal)

Remaining Snyk findings (csv-parse via cli-utilities > tty-table > csv,
and deepmerge with no fix published upstream) are parked in
needs-human-review — see PR description.

Co-authored-by: Claude <noreply@anthropic.com>

Author: dhruv-parekh-cs

package-lock.json

@@ -31,7 +31,7 @@
     "@rollup/plugin-typescript": "^12.1.2",
     "@types/express": "^4.17.21",
     "@types/express-serve-static-core": "^4.17.34",
-    "adm-zip": "^0.6.0",
+    "adm-zip": "^0.6.1",
     "chalk": "^4.1.2",
     "cross-fetch": "^4.1.0",
     "dotenv": "^16.4.7",
@@ -105,8 +105,6 @@
     "prepare": "husky"
   },
   "overrides": {
-    "lodash": "^4.18.1",
-    "form-data": "4.0.6",
     "ajv": "^8.18.0",
     "eslint": {
       "ajv": "^6.12.6"
@@ -116,8 +114,8 @@
     },
     "qs": "^6.16.0",
     "tmp": "^0.2.4",
-    "fast-uri": "^3.1.7",
-    "js-yaml": "^4.3.1",
+    "fast-uri": "^3.1.8",
+    "proxy-addr": "^2.0.8",
     "minimatch@10.2.5": {
       "brace-expansion": "^5.0.9"
     },