fix(docker): upgrade npm to remediate 11 HIGH CVEs in bundled dependencies
All findings are in npm's own bundled packages (cross-spawn, glob,
minimatch, tar). Upgrading npm to latest pulls in the patched versions:
- cross-spawn ≥7.0.5 (CVE-2024-21538)
- glob ≥10.5.0 (CVE-2025-64756)
- minimatch ≥9.0.6 (CVE-2026-26996, CVE-2026-27903, CVE-2026-27904)
- tar ≥7.5.11 (CVE-2026-23745, CVE-2026-23950, CVE-2026-24842,
CVE-2026-26960, CVE-2026-29786, CVE-2026-31802)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>