Consolidate open Dependabot updates into one dependency bump

[gfs]

Folds the five open Dependabot pull requests for the VS Code extension into a single change, so the new .github/dependabot.yml grouping (#770) starts from a clean slate.

Supersedes #765, #766, #767, #768 and #769 — GitHub's closing keywords only auto-close issues, not pull requests, so those five need closing by hand (or Dependabot will retire them itself on its next run once these versions are on main).

Straightforward bumps

Cherry-picked as-is from the Dependabot branches:

PR	Bump
#765	linkify-it 5.0.1 → 5.0.2
#766	fast-uri 3.1.2 → 3.1.4
#768	undici 7.24.6 → 7.29.0
#769	brace-expansion 1.1.14 → 1.1.16 and 5.0.5 → 5.0.8

🚩 Three of Dependabot's pins point at versions that no longer exist

brace-expansion 1.1.18 and 5.0.9 (#769, #767) and minimatch 10.2.6 (pulled in by #767) have been removed from the npm registry. The packument no longer records them even in its time field, and the tarballs 404 on every mirror — including the pipeline's own PublicRegistriesFeed:

npm error 404 Not Found - GET .../PublicRegistriesFeed/npm/registry/brace-expansion/-/brace-expansion-1.1.18.tgz
  Cannot find the file brace-expansion-1.1.18.tgz in package 'brace-expansion 1.1.18' in feed 'PublicRegistriesFeed'

The first push of this branch reproduced exactly that failure in DevSkim-VSCode-PR, which is also what #767 and #769 would have hit had the Azure DevOps pipelines run on Dependabot's branches. They're pinned here to the newest releases that do exist — 1.1.16, 5.0.8 and 10.2.5 (current latest for both packages).

Worth knowing independently of this PR: Dependabot can pin versions that later vanish, and nothing in the current setup notices until a build breaks.

The other one that wasn't straightforward: #767

#767 also bundled a major vscode-languageclient 7 → 10 bump, which does not build on its own. It's carried here with the migration it needs:

• node16 module resolution. vscode-languageclient 10 dropped main/types and declares its entry points only through exports, which node10 resolution can't see — tsc fails with Cannot find module 'vscode-languageclient/node'. Both tsconfig.json files move to module/moduleResolution: node16. The client has no "type": "module", so it still emits CommonJS, matching the esbuild --format=cjs bundle step.
• typescript ^4.5.5 → ^5.9.3. The v10 type declarations use the NoInfer utility type (TypeScript 5.4+); with 4.9.5 you get ~40 TS2304: Cannot find name 'NoInfer' errors out of node_modules.
• client/extension.ts lifecycle migration. LanguageClient.start() returns Promise<void> instead of a Disposable, and onReady() was removed in v8. Notification handlers now register before start() — v10 queues them in _pendingNotificationHandlers and wires them when the connection opens, so nothing sent during initialization can be missed — and the client itself goes into context.subscriptions.
• engines.vscode ^1.63.0 → ^1.91.0 (root and client), which vscode-languageclient 10 requires. @types/vscode is pinned to the matching 1.91.0 rather than floating to latest, so the extension isn't type-checked against APIs newer than the version it claims to support.

⚠️ This drops support for VS Code 1.63 – 1.90

That's the unavoidable cost of vscode-languageclient 10 and the main thing worth a second opinion on. Ping me if you'd rather split the migration out and land only the mechanical bumps.

Verification

• npm ci in both DevSkim-VSCode-Plugin/ and DevSkim-VSCode-Plugin/client/ — every integrity hash verifies
• npm run compile (tsc -b) — clean
• npm run lint (eslint ./client) — clean
• npm run esbuild-base — bundles at 959.4 kb

Not verified here: the extension end-to-end against the language server. The .NET server uses OmniSharp.Extensions.LanguageServer 0.19.9 (LSP 3.16/3.17) and the client now speaks protocol 3.18. That's backwards compatible by design — capabilities are negotiated — but a manual smoke test in the Extension Development Host is worth doing before merge, since there's no automated integration coverage.

Note on lockfile provenance

registry.npmjs.org isn't reachable from my environment, only an Azure Artifacts mirror. So rather than regenerating lockfiles (which would have rewritten resolved URLs to the mirror and downgraded sha512 integrity to the mirror's sha1 shasums), I kept Dependabot's entries and hand-edited only the lines that changed — typescript, @types/vscode, and the three repinned packages above.

Their sha512 values were computed from the actual tarballs. The method was cross-checked against undici 7.29.0 and brace-expansion 5.0.8, whose hashes reproduce Dependabot's exactly, and the whole tree then verified with a real npm ci in both directories.

Changelog

Entry added under [1.0.96], from nbgv get-version -v SimpleVersion on this branch rebased on main (main is 1.0.95). If other PRs merge ahead of this one the git height shifts, so the heading needs a re-check before merging.