deps: resolve major-version Dependabot security alerts (category 2)

[laileni-aws]

Problem

Follow-up to #136 (which resolved the safe, non-breaking Dependabot alerts).
The remaining open alerts require major-version bumps or coordinated
transitive upgrades that carry more risk and need CI validation.

Stacked on #136. This branch is based on fix/dependabot-security-alerts,
so its diff currently includes #136's commits too. Once #136 merges, this PR
shows only the category-2 delta (commit deps: resolve major-version Dependabot alerts (category 2)).

Solution

Apply the major-version security fixes on top of #136, bringing the total to
152 of 160 resolved. webpack is intentionally kept at ^5.95.0 (see
#136) so the web build stays green.

Category-2 changes (net-new in this PR)

Change	Alerts	Type
markdown-it 13 → ^14.2.0 (+ @types/markdown-it ^14.1.2)	#71, #72, #224, #226	major bump (core)
linkify-it → 5.0.1	#241	pulled with markdown-it 14
esbuild-loader 2.20.0 → 4.5.0 (ESBuildMinifyPlugin → EsbuildPlugin)	#5	major bump + code change
webpack-dev-server ^4.15.2 → ^5.2.5	#17, #18, #209, #233	major bump
fast-xml-parser → 5.7.0 (root + both src.gen)	#70, #107–#110, #122, #130, #149, #150, #179, #180, #185, #192, #193	forced 5.x (see risk)
jsonata → 2.2.1	#243	override
js-yaml@4 → 4.2.0 (scoped; 3.x untouched)	#33, #34, #242, #244	scoped override
@smithy/config-resolver, @opentelemetry/core → patched lines	partial	range update

⚠️ Risk to validate in CI

fast-xml-parser GHSA-gh4j is patched only in 5.7.0 (no 4.x backport), so
this forces the AWS SDK (which pins the 4.x line) onto 5.x via override. AWS SDK
v3's XML usage is basic and generally 5.x-compatible, but XML-based SDK
responses (S3, EC2, CloudFormation, …) should be exercised before merge.

Still open after this PR (8 alerts)

Alert(s)	Reason
webpack #68, #69	Patched webpack pulls enhanced-resolve 5.24 which breaks the web build; needs a dedicated fix (webpack bump + core exports/web resolve compatibility). Build-time SSRF in the unused buildHttp feature — negligible risk. Tracked as a follow-up commit on this PR.
aws-sdk #42, #44	No patched version exists (v2, maintenance)
elliptic #43	No patched version exists (<=6.6.1, no fix released)
@opentelemetry/core #225	OTel 2.0.0 family pinned by @aws/language-server-runtimes; needs that package upgraded
@smithy/config-resolver #41	Old smithy pinned by old @aws-sdk v3 clients; needs those clients upgraded
@protobufjs/utf8 #200	Stale/false positive — already fixed via protobufjs@7.6.3

Verification

• npm audit (lockfile-only) on all three lockfiles; both src.gen report 0
  critical / 0 high.
• All three lockfiles verified idempotent.
• webpack/enhanced-resolve pinned to main's versions (5.95.0 / 5.17.1).

Draft: opened as a draft for CI validation of the major bumps (especially
the fast-xml-parser 5.x force).

---

• Treat all work as PUBLIC. Private feature/x branches will not be squash-merged at release time.
• Your code changes must meet the guidelines in CONTRIBUTING.md.
• License: I confirm that my contribution is made under the terms of the Apache 2.0 license.