Fix audited dependency vulnerabilities

[RolandSall]

Summary

• refresh the lockfile so compatible transitive security patches are selected
• replace vulnerable transitive resolutions for @grpc/grpc-js, Handlebars, and source-map-js
• keep an unfiltered audit:all command while CI ignores one development-only advisory with no published patch

What the audit found

The failing main-branch audit reported 16 advisories: 2 critical, 8 high, 5 moderate, and 1 low.

Package	Reachability	Resolution
@grpc/grpc-js	example-only Testcontainers/Docker transitive	pinned to 1.14.6
brace-expansion	development/example tooling transitive	clean lockfile resolves patched releases within each dependency's major
handlebars	ts-jest development transitive	pinned to 4.7.10
source-map-js	build/test development transitive	pinned to 1.2.2
sprintf-js	Jest coverage development transitive	no patched npm version exists; see exception below

The published @integration-testing/data-isolation package does not have a runtime dependency on Testcontainers, Jest, Vitest, Prisma, PostgreSQL, or TypeORM; those integrations remain optional peers or repository examples.

Explicit audit exception

GHSA-hp3w-g68c-fv3c affects sprintf-js@1.0.3 through Jest's coverage stack. The advisory currently lists no patched npm release. It is not reachable from the published package runtime. CI ignores only this GHSA, and bun run audit:all remains available to expose it.

After these changes, the unfiltered audit reports only that one moderate development-only advisory. The CI audit reports zero non-ignored vulnerabilities.

Verification

• bun install --frozen-lockfile passed
• bun run verify passed
• bun run pack:check:docker passed
• bun run test:runners:minimum passed for Jest and Vitest
• bun run test:consumer passed, including PostgreSQL Testcontainers, Prisma, pg, TypeORM, SQLite, per-file execution, and standalone packed-package installation

No package version, npm publication, tag, or release is part of this PR.