Update vulnerable npm dependencies

[Copilot]

Component Governance reported vulnerable npm dependency versions for @opentelemetry/core, brace-expansion, and js-yaml. This updates the applicable dependency graph without overrides or force installs, including the telemetry API adjustment needed after the OpenTelemetry-related upgrade.

• Dependency updates

  • Upgraded @vscode/extension-telemetry, removing the vulnerable @opentelemetry/core transitive tree.
  • Refreshed server/root lockfiles so brace-expansion and js-yaml resolve to fixed versions.
  • Updated related root transitive tooling packages where normal semver resolution cleared remaining audit findings.

• Telemetry compatibility

  • Updated the telemetry reporter import for the newer package export shape:

import { TelemetryReporter } from '@vscode/extension-telemetry';

• Validation
  • Verified compile, lint, server tests, npm audits, secret scan, and CodeQL validation.

• Fixes Update vulnerable npm dependencies #192

[Raymond Zhao (rzhao271)]

Copilot Redo the bumps, taking the 7 day minimum release age into account.

[Copilot]

Copilot Redo the bumps, taking the 7 day minimum release age into account.

Addressed in 7277f3a by moving the too-new transitive lockfile selections to fixed releases older than the 7-day cutoff: brace-expansion@2.1.4, brace-expansion@5.0.9, and morgan@1.12.0.