Fix npm dependency alerts

[lancewillett]

Summary

• Adds npm overrides for vulnerable transitive dev dependencies: tmp, shelljs, cross-spawn, and micromatch.
• Refreshes package-lock.json with the patched transitive versions.

Validation

• npm install --package-lock-only --ignore-scripts --audit=false --fund=false
• npm audit --audit-level=high --omit=optional
• git diff --check

[GaryJones]

Thanks @lancewillett.

We have Dependabot set up on this repo to handle dependency updates, including transitive dependencies, for security reasons. Is there a need to push these through urgently, or were you just sweeping alerts across repos?

[lancewillett]

@GaryJones This was a test of an upcoming tool from QualityOps, I was sweeping up only critical alerts on all a8c repos.