chore(deps): bump ws to 8.20.1 in lockfile

Resolves GHSA-58qx-3vcg-4xpx / CVE-2026-45736 (uninitialized memory
disclosure in ws.close() when a TypedArray is passed as reason).

ws is a transitive dependency of jsdom@^24.1.3, whose declared range
(^8.18.0) already permits 8.20.1. The lockfile entry was updated from
8.18.0 to the patched version via `npm update ws --package-lock-only`.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: github-actions[bot]