fix SCA vulnerabilities in OSS-scan test fixture (nanoid, browserslist, brace-expansion)

Root package.json already overrode these packages; the ast-vscode-extension
sample manifest under src/tests/data was still pinned to vulnerable versions
and was being picked up by SCA scans. Adds matching overrides and bumps the
fixture lockfile:
- nanoid 3.3.3 -> 3.3.17 (CVE-2026-67213, CVE-2026-67214, CVE-2026-73086, CVE-2024-55565)
- brace-expansion 1.1.11 -> 1.1.21 (CVE-2026-102276, CVE-2026-102277, CVE-2026-102278)
- browserslist 4.22.3 -> 4.28.7 (CVE-2026-73088, CVE-2026-73089)

braces@3.0.3 (CVE-2026-93687) and uri-js@4.4.1 (CVE-2026-93690, CVE-2026-93751)
are left as-is: both are the latest versions ever published upstream, so no
version bump can resolve them. Dev-only transitive deps, not shipped in
dist/main/**.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: cx-rahul-pidde

src/tests/data/package-lock.json

@@ -770,7 +770,10 @@
 				"webpack-cli": "^4.10.0"
 		},
 		"overrides": {
-			"bluebird": "3.7.2"
+			"bluebird": "3.7.2",
+			"nanoid": "3.3.17",
+			"browserslist": "4.28.7",
+			"brace-expansion": "1.1.21"
 		},
 		"displayName": "Checkmarx",
 		"engines": {