Update @vscode/vsce to 4.0.0

4.0 raises the Node baseline to 22 (we run 24), swaps glob for
tinyglobby, and trims its dependency tree. The packaged VSIX is
byte-identical apart from the version string, file modes included, and
publish still reads VSCE_PAT before touching the credential store, so
CI never hits the new migration prompt.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: nedtwigg