fix(deps): add npm overrides for form-data and regenerate package-lock.json (UID2-7307)

Trivy scans package-lock.json in addition to yarn.lock. The previous fix
updated yarn.lock but not package-lock.json, so Trivy still flagged
form-data 2.5.5 (@types/request transitive) and protobufjs 8.2.0.

Adds npm overrides for:
- form-data: >=4.0.6 (top-level)
- @types/request > form-data: 2.5.6 (nested, mirrors yarn resolution)

Regenerated package-lock.json now resolves:
- node_modules/form-data -> 4.0.6
- node_modules/@types/request/node_modules/form-data -> 2.5.6
- node_modules/protobufjs -> 8.6.3

Author: sophia-chen-ttd