security: patch VS Code extension dev-dependency transitives

Refresh editors/vscode/bun.lock to clear every advisory bun audit reports for
the extension's dev/test/packaging transitive deps (pulled by mocha and
@vscode/vsce). These are real GitHub advisories but are not separately tracked
by this repo's Dependabot; clearing them alongside alert #2 keeps the lockfile
green.

mocha constrains serialize-javascript and diff below their patched releases, so
the patched versions are forced via package.json `overrides`:

- serialize-javascript 6.0.2  -> 7.0.5   GHSA-5c6j-r48x-rmvq (RCE) + GHSA-qj8w-gfj5-8c6v (DoS)
- diff                 7.0.0  -> 8.0.4   GHSA-73rr-hh4g-fpgx (jsdiff DoS)
- qs                   6.15.1 -> 6.15.2  GHSA-q8mj-m7cp-5q26 (DoS)
- fast-uri             3.1.1  -> 3.1.2   GHSA-v39h-62p7-jpjc (host confusion)
- tmp                  0.2.5  -> 0.2.7   GHSA-ph9p-34f9-6g65 (path traversal)
- brace-expansion      5.0.5  -> 5.0.6   GHSA-jxxr-4gwj-5jf2 (DoS)

Not shipped in the extension bundle. bun audit reports no vulnerabilities;
tsc, the esbuild bundle, and 155 unit tests pass.

https://claude.ai/code/session_01UT8dyBo9sjkBDNbAbAUVgs

Author: claude