DATA-12994: clear high audit alerts and schedule npm audit

[pragyash258]

Jira: DATA-12994

Follow-up to #35 for DATA-12994 after the Security retest.

Changes

• package-lock.json: npm audit fix --package-lock-only, kept at lockfile v1. Clears the critical (minimist) and all high Dependabot alerts. Dev dependencies only - the production tree (cls-hooked, uuid) is unchanged.
• .github/workflows/npm-audit.yml: add a weekly schedule and workflow_dispatch, so the gate runs on an idle repo and the audit check stays selectable as a required status check.

Validation

• npm audit --omit=dev --audit-level=high passes. 6 moderate dev/uuid advisories remain, none high or critical.
• npm test passes. eslint lib test reports the same 11 pre-existing errors as master.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Central YAML (base), Organization UI (inherited), Workspace UI (inherited)
• Review profile: ASSERTIVE
• Plan: Enterprise
• Run ID: 04391276-7a01-4887-9915-79b2a2b25880

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}