Fix mocha version collision breaking Cypress reporters (#2073)

* fix obs test failures: pin mocha to Cypress bundled version

The CVE-fix commit (#2068) migrated this repo from yarn to npm. Under
npm, the reporters' mocha peerDependency auto-installs a top-level
mocha@11, which conflicts with Cypress 13.17's bundled mocha@7.0.1 and
breaks the reporter (test.slow is not a function).

Pin mocha to 7.0.1 via overrides so both cypress-multi-reporters and
mocha-junit-reporter resolve against the same mocha Cypress runs.

Lockfile is updated incrementally from the working main lockfile so it
stays in sync (npm ci) and keeps ajv@8.20.0 top-level with eslint's
nested ajv@6.15.0 (lint passes).

Signed-off-by: Adam Tackett <tackadam@amazon.com>

* Pin dorny/paths-filter to commit SHA in dashboard-variable workflow

This workflow was missed in c791b5b (Pin GitHub Actions to commit SHAs).
The org policy rejects unpinned actions, failing the 'changes' job. Use
the same SHA (4512585405083f25c027a35db413c2b3b9006d50 # v2) already used
by the other 20 e2e workflows.

Signed-off-by: Adam Tackett <tackadam@amazon.com>

---------

Signed-off-by: Adam Tackett <tackadam@amazon.com>
Co-authored-by: Adam Tackett <tackadam@amazon.com>

Author: TackAdam

.github/workflows/dashboard-variable-release-e2e-workflow.yml

@@ -9,7 +9,7 @@ jobs:
     outputs:
       tests: ${{ steps.filter.outputs.tests }}
     steps:
-      - uses: dorny/paths-filter@v2
+      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2
         id: filter
         with:
           filters: |