chore(deps): batch low-risk dependabot updates

[karenc-bq]

Summary

Batches the six low-risk Dependabot updates into one PR. All are dev/test-only or transitive; none change shipped runtime behavior.

Applied by cherry-picking each Dependabot commit, so the exact lockfile resolutions and original authorship are preserved.

Supersedes	Bump	Scope
#675	tar 7.5.13 → 7.5.22	lock-only (dev tree)
#671	axios 1.16.1 → 1.18.1	in-range minor; optional peer
#667	sigstore 4.1.0 → 4.1.1	lock-only (publish tooling)
#661	form-data 4.0.5 → 4.0.6	lock-only, transitive
#657	esbuild 0.28.0 → 0.28.1	lock-only patch
#595	cross-env 7.0.3 → 10.1.0	major, but dev-only script wrapper

package.json changes are limited to axios (devDependencies + peerDependencies) and cross-env (devDependencies). Everything else is package-lock.json.

Also closes #666 and #665 as already-included

sigstore@4.1.1 (#667) resolves @sigstore/core@3.2.1 and @sigstore/verify@3.1.1 in its own lockfile, so those two PRs are fully subsumed rather than separate work. Verified in the resulting lock:

4.1.1  node_modules/sigstore
3.2.1  node_modules/@sigstore/core
3.1.1  node_modules/@sigstore/verify

Verification

Run locally, since .github/workflows/main.yml does not run tsc and ts-jest has diagnostics: false — a green CI check alone does not prove the published dist/ still compiles.

• npx tsc --noEmit — exit 0
• npm test — 712 passed / 42 of 43 suites (see below)
• prettier --check on both changed files — clean
• npm install — clean resolution; all eight target versions confirmed present

Pre-existing failures, not caused by this PR

Two unit failures reproduce identically on unmodified origin/main:

• okta_credentials_provider (testGetSamlAssertion, testGetSamlAssertionUrlScheme) — this test does jest.spyOn(axios, "request"), so an axios regression was the obvious suspect. Ruled out by pinning axios back to 1.16.1 on this branch (fails the same) and re-running on a clean origin/main checkout (fails the same).
• custom_endpoint_monitor_impl (testRun) — passes in isolation; a sleep(100) timing flake under parallel test load.

Notes for reviewers

Related PR: #678

Remaining open Dependabot PRs are intentionally excluded: #659 (OpenTelemetry) moves four shipped dependencies and consumer-visible peer ranges, so it deserves its own PR; #655 (dotenv 17) needs a { quiet: true } fix first; #639, #656, and #654 are blocked or broken.

[kenrickyap]

LGTM