Patch dependency vulnerabilities

[afoote-mitre]

Summary

Patch the actionable dependency vulnerabilities without changing endpoint behavior.

Changes and Rationale

Change	Primary files	Why it was needed
Update proxy-addr from 2.0.7 to 2.0.8	package-lock.json	Resolves the critical proxy-address advisory and incorporates the update proposed by Dependabot #171.
Update Morgan from 1.12.0 to 1.12.1	package.json, package-lock.json	Incorporates the logging security update proposed by Dependabot #154.
Update the Axios override from 1.18.0 to 1.20.0	package.json, package-lock.json	Removes the currently reported Axios advisories while retaining the existing upstream dependency.
Update brace-expansion from 5.0.9 to 5.0.12 and adm-zip from 0.6.0 to 0.6.1	package.json, package-lock.json	Moves the existing overrides beyond the vulnerable ranges currently reported by npm audit and Docker Scout.

Remaining Findings

• The fresh runtime image scan reports two critical and two high advisories, all in simple-git and @simple-git/argv-parser, introduced exclusively through cve-core. These packages will be removed by Remove cve-core dependency #163, which follows this PR.
• The full development dependency audit still reports the braces stack-exhaustion advisory, GHSA-vfj7-8cjw-p6xm. It has no published patched version and is absent from the production image. No blanket major-version upgrade or advisory dismissal is included.
• The adm-zip symlink advisory GHSA-vwc7-r8mq-g2x9 has no declared patched release, despite its current affected range ending at 0.6.0. Remove cve-core dependency #163 removes the package entirely.