deps: bump engine.io to 6.6.9 in zcm/js/node (GHSA-gr94-w7qr-f4j3, GHSA-r635-g3xr-vw7x)

[katsugtgz]

Bumps engine.io to address GHSA-gr94-w7qr-f4j3 and GHSA-r635-g3xr-vw7x.

Evidence:

• zcm/js/node/package-lock.json resolved engine.io@6.6.4
• npm audit reported both advisories (high) before the update
• updated version: 6.6.9

Validation:

• npm audit no longer reports either advisory after the update
• npm install --ignore-scripts in zcm/js/node succeeds and require('engine.io') loads
• npm ls engine.io shows socket.io@4.8.1 -> engine.io@6.6.9

Note: npm audit still reports separate advisories for other packages in the tree (ip-address, brace-expansion). This patch only clears the two engine.io advisories.

Scope: zcm/js/node/package-lock.json only.