Replace deprecated vsce to remediate linkify-it vulnerability

[jainakanksha-msft]

Summary

• replace the deprecated vsce development dependency with @vscode/vsce 3.9.2
• update the VS Code packaging dependency graph to resolve linkify-it 5.0.2
• remediate GHSA-v245-v573-v5vm / CVE-2026-59887 without forcing an unsupported transitive override
• document the security update in the changelog

Validation

• npm run test:package-scripts
• npm explain linkify-it resolves @vscode/vsce@3.9.2 -> markdown-it@14.3.0 -> linkify-it@5.0.2
• npm audit reports no linkify-it finding
• npm run vscode:pack -- --out /tmp/azurite-linkify-validation.vsix

[Copilot]

Pull request overview

Updates the VS Code extension packaging toolchain by replacing the deprecated vsce dependency with @vscode/vsce, primarily to pull in a non-vulnerable linkify-it version and remediate the referenced GHSA/CVE without relying on transitive overrides.

Changes:

• Replace deprecated vsce devDependency with @vscode/vsce ^3.9.2.
• Refresh package-lock.json to reflect the new dependency graph, including markdown-it@14.3.0 → linkify-it@5.0.2.
• Document the security/tooling update in ChangeLog.md.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
package.json	Swaps vsce for @vscode/vsce in devDependencies while keeping vsce CLI scripts intact.
package-lock.json	Updates resolved dependency tree to include @vscode/vsce@3.9.2 and linkify-it@5.0.2, removing older vsce-derived packages.
ChangeLog.md	Adds a changelog entry describing the dependency migration and security remediation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.