feat: npm audit

[ieow]

Motivation and Context

npm audit reported vulnerable transitive dependencies in the lockfile. This PR hardens the dependency tree by pinning patched versions via npm overrides, and removes a few unused dev dependencies. No SDK or published runtime behavior changes are intended.

Jira Link:

Description

• Add npm overrides in package.json for lodash (^4.17.24), tmp (^0.2.7), and serialize-javascript (^7.0.5) so transitive packages resolve to patched versions flagged by npm audit.
• Refresh package-lock.json to apply the overrides and dependency cleanup.
• Remove unused dev dependencies: @typescript-eslint/eslint-plugin and mocha (tests run via Node's built-in test runner).
• In tests/importRecovery.spec.ts, import AsyncStorage, enable resetStore() during account reset for more reliable test isolation, and remove a debug console.log.

How has this been tested?

• npm install completes successfully with the updated lockfile
• npm audit no longer reports the addressed transitive vulnerabilities
• npm run lint passes
• npm test passes (including tests/importRecovery.spec.ts)

Screenshots (if appropriate):

N/A — dependency and test maintenance only.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

• My code follows the code style of this project. (run lint)
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.
• My code requires a db migration.

---

Note

Low Risk
Dependency and test-harness maintenance only; no intended SDK or runtime behavior changes beyond safer resolved package versions.

Overview
Addresses npm audit findings by forcing transitive packages to patched releases through new overrides in package.json for lodash, tmp, and serialize-javascript, with package-lock.json updated to match.

Trims dev tooling by dropping direct @typescript-eslint/eslint-plugin and mocha (tests already use Node’s built-in runner). tests/importRecovery.spec.ts tightens isolation: AsyncStorage import, resetStore() during account reset, and removal of a debug log.

^{Reviewed by Cursor Bugbot for commit 5561a99. Bugbot is set up for automated code reviews on this repo. Configure here.}