build: update vulnerable Node dependencies

[ryanduguid]

What changed

• update Axios to 1.19.0, including fixed follow-redirects and form-data transitives
• update ts-jest so its Handlebars dependency resolves to 4.7.9
• update vulnerable transitive build/test packages within compatible ranges
• update Sinon to 22.1.0 to remove the final vulnerable diff dependency
• reconcile the lockfile's root package metadata with version 19.1.0

Why

The existing lockfile resolves vulnerable production and development dependencies and reports stale root package metadata. This deliberately updates the manifest and lockfile together rather than applying a forced audit rewrite.

Validation

• clean npm ci
• npm audit — zero vulnerabilities
• npm audit --omit=dev — zero vulnerabilities
• npm run build
• npm test -- --runInBand — 16 tests passed
• git diff --check