ci: add audit-ci allowlist for known false-positive advisories

Replace the bare 'npm audit --audit-level high' gate with audit-ci,
which supports an allowlist of advisories. npm audit itself has no
ignore mechanism, and the newly registered GHSA-hp3w-g68c-fv3c
(sprintf-js) and GHSA-vfj7-8cjw-p6xm (braces) advisories are false
positives that the maintainers will not fix upstream: sprintf-js
already raises an exception for unbounded precision specifiers, and
the braces advisory only applies to code that misuses the library.

- Add audit-ci.jsonc with the two allowlisted advisories, including
  justifications and removal instructions.
- CI keeps the previous churn profile: fail on high or critical.
- Add 'npm run audit' as the local equivalent with a strict low gate,
  so a fully clean report remains enforced locally.
- Refresh package-lock.json.

Author: Container

.github/workflows/main.yml

@@ -91,7 +91,8 @@ jobs:
     - run: rm package-lock.json
     - run: npm install
     - run: npm run install-test-browsers
-    - run: npm audit --audit-level high
+    # Security audit with allowlisted false positives (audit-ci.jsonc)
+    - run: npx --yes audit-ci@^7 --config audit-ci.jsonc --report-type summary
     - run: npm run setup-website
     - run: npm run ci-xvfb
     - run: npm run ci-build-website

audit-ci.jsonc

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
+  // CI (`.github/workflows/main.yml`) runs `npx audit-ci@^7 --config audit-ci.jsonc`,
+  // which fails on high or critical advisories, matching the previous
+  // `npm audit --audit-level high` gate. The local `npm run audit` script adds
+  // `--low` on top of this config, so locally every advisory of any severity
+  // fails unless it is allowlisted here.
+  "high": true,
+  "allowlist": [
+    // False positive: sprintf-js raises an exception for unbounded precision
+    // specifiers instead of expanding them; the maintainers will not change
+    // this behavior. https://github.com/advisories/GHSA-hp3w-g68c-fv3c
+    // (npm advisory 1241202). Remove this entry if the advisory is retracted.
+    "GHSA-hp3w-g68c-fv3c",
+    // False positive: the reported uncontrolled resource consumption requires
+    // application code that misuses the library; geojs does not expose such
+    // usage. https://github.com/advisories/GHSA-vfj7-8cjw-p6xm
+    // (npm advisory 1240992). Remove this entry if the advisory is retracted.
+    "GHSA-vfj7-8cjw-p6xm"
+  ]
+}