fix(build): releaseProd died on nullish coalescing - terser 3 can't parse it

gulp-minify@3.1.0 bundles terser 3.17 (2019), which predates ES2020
syntax. A single `?? 9` in VulnerabilityInspection.js (part of the core
bundle via extensionsIntegrated) crashed makeJSDist with the line-less
"Cannot read properties of undefined (reading 'replace')" error. Dev
builds run unminified in Chromium, which parses `??` natively - so this
only surfaces in the prod pipeline.

Replaced with an `in`-guarded rank lookup (same semantics: critical maps
to rank 0, which is falsy, so a plain || fallback would mis-sort it -
covered by the existing dedup/sort spec).

Swept all shipped src for other ES2020+ syntax (?. / ?? / logical
assignment): this was the only real occurrence. Constraint: shipped src/
must stay at ES2019 syntax until the minifier is upgraded; src-node,
tests and src-mdviewer are exempt.

releaseProd now completes: 53s, dist size validation green (72.94 MB).
unit:JSONSupport 18/18.

Author: abose

src/extensionsIntegrated/JSONSupport/VulnerabilityInspection.js

@@ -172,8 +172,12 @@ define(function (require, exports, module) {
             seen.add(advisory.id);
             return true;
         }).sort(function (a, b) {
-            // ?? not ||: critical maps to 0, which is falsy
-            return (SEVERITY_ORDER[a.severity] ?? 9) - (SEVERITY_ORDER[b.severity] ?? 9);
+            // `in`-guarded, not ||: critical maps to rank 0, which is falsy. Also NOT `??` -
+            // the prod bundle's minifier (gulp-minify's terser 3) predates nullish coalescing
+            // and dies on it with an unhelpful "reading 'replace'" error in makeJSDist.
+            const rankA = (a.severity in SEVERITY_ORDER) ? SEVERITY_ORDER[a.severity] : 9;
+            const rankB = (b.severity in SEVERITY_ORDER) ? SEVERITY_ORDER[b.severity] : 9;
+            return rankA - rankB;
         }).slice(0, MAX_ADVISORIES_PER_DEP).map(function (advisory) {
             return {
                 pos: entry.pos,