fix(js-sdk-release-tools): upgrade vitest 3.2.4 → 4.1.0 (CVE-2026-47429 / GHSA-5xrq-8626-4rwp) (#15858)

* Initial plan

* fix: upgrade vitest from 3.2.4 to 4.1.0 to fix CVE-2026-47429

Co-authored-by: mikeharder <9459391+mikeharder@users.noreply.github.com>

* fix: bump CI Node version from 18.x to 20.x for vitest@4.1.0 compatibility

Co-authored-by: mikeharder <9459391+mikeharder@users.noreply.github.com>

* Apply suggestion from @mikeharder

* fix: add missing esbuild 0.28 subtree to package-lock for vite@8 peer dep (npm ci sync)

Co-authored-by: mikeharder <9459391+mikeharder@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: mikeharder <9459391+mikeharder@users.noreply.github.com>
Co-authored-by: Mike Harder <mharder@microsoft.com>

Author: Copilot

tools/js-sdk-release-tools/ci.yml

@@ -37,7 +37,7 @@ extends:
           - template: /eng/pipelines/templates/variables/globals.yml
           - template: /eng/pipelines/templates/variables/image.yml
           - name: NodeVersion
-            value: '18.x'
+            value: '22.x'
 
         jobs:
           - job: Build