Fix vulnerable dependency graph

[rogu3bear]

Summary

• refresh vulnerable dependency graph for MCP SDK, Xero SDK transitives, ESLint tooling, and parser/glob packages
• add targeted npm overrides for vulnerable transitive packages that remain below patched versions through dependency ranges
• preserve the current upstream 0.0.16 source/test changes while regenerating package-lock.json

Verification

• npm audit
• npm run build
• npm run lint
• npm test

Notes

• npm audit now reports found 0 vulnerabilities.
• Bun currently warns that nested overrides are unsupported, so bun audit does not honor the npm lockfile/override graph used by this upstream npm package.

[rogu3bear]

Updated this security PR with commit 8b230aa to clear the remaining npm audit advisories.

Proof after the update:

• npm audit -> 0 vulnerabilities
• npm run build
• npm run lint
• npm test -> 1 Vitest file / 14 tests passed