chore: fix npm audit vulnerabilities

[nmccready-tars]

npm audit fix

What changed

• Updated ajv from 8.17.1 → 8.18.0 (fixes ReDoS vulnerability GHSA-2g4f-4pwh-qvx6)

Audit summary

• Before: 29 vulnerabilities (7 moderate, 22 high)
• After: 29 vulnerabilities (7 moderate, 22 high)

The root ajv was updated, but the vulnerability count remains the same because the remaining 29 vulnerabilities are all in nested/transitive dependencies that cannot be resolved without breaking changes:

• ajv (moderate): Still vulnerable in nested copies under eslint and serve — fix requires major version bumps (eslint@4→10, serve@6→14)
• fast-xml-parser (high, 22 vulns): Transitive dep of @aws-sdk/* packages and commit-and-tag-version — requires upstream AWS SDK update
• commit-and-tag-version: Depends on vulnerable fast-xml-parser

--force was NOT used

Running npm audit fix --force was tested but increased vulnerabilities from 29 to 40 by downgrading packages (eslint@4.1.1, serve@6.5.8) which introduced additional critical/high vulns (handlebars, cross-spawn, minimist, ip, send, tmp). Reverted.

Tests

All 197 tests passing ✅