[SP-15258] Upgrade remaining flagged and stale dependencies

[anaptfox]

What

• Bump losant-rest 2.14.1 -> 3.0.0 and jsonwebtoken -> ^9.0.3. losant-rest 3.0.0 carries a patched axios (^1.10.0), clearing ~24 Dependabot alerts (SSRF, prototype pollution, DoS, credential leaks) from the old vendored 0.21.4/0.31.x. Stayed on 3.x rather than latest 4.x, which is ESM-only ("type": "module") and would break our CommonJS require('losant-rest') in lib/get-api.js.
• Bump dev-only tooling: mocha 10 -> 11, sinon 15 -> 22, husky 8 -> 9, lint-staged 13 -> 17. None ship to users. Migrated .husky/pre-commit and the prepare script to husky v9's simplified hook format.
• Bump inquirer 8 -> 14 and update-notifier 5 -> 7 — both real runtime dependencies whose newer majors are ESM-only. Bridged via dynamic import() rather than converting the whole CLI to ESM:
  • lib/inquirer.js — a small cached-import wrapper; every call site still does require('./inquirer').prompt(...), unchanged. Tests that sinon.stub(inquirer, 'prompt') now require the wrapper too, so they stub the same object the source uses.
  • bin/losant.js — update-notifier's single call site becomes a fire-and-forget dynamic import at the bottom of the file; doesn't block or affect command parsing above it.
• Add pnpm-workspace.yaml overrides forcing serialize-javascript (RCE + DoS) and diff (DoS) past patched thresholds. Both are transitive-only via mocha, which still pins ^6.0.2/^7.0.0 itself (below the patched 7.0.5/8.0.3) — no mocha release fixes this yet, so a version bump alone can't reach it.
• Fix .gitignore's blanket *.yaml rule, which was silently ignoring the new pnpm-workspace.yaml until excepted.

Testing

• pnpm lint — passing
• pnpm test — 55/55 passing
• pnpm audit — no known vulnerabilities found
• Manual smoke test: node bin/losant.js --version / --help, and a live (non-mocked) inquirer.prompt() call to confirm the dynamic import resolves at runtime, not just under test mocks
• GitHub Actions (Linter + Run Tests) — pending on push

[spacetc62]

@eeerin do you recall why losant-rest was pinned to an exact version?

[eeerin]

No but should it be 4.2.1?