SECVULN-37255: upgrade dependencies to resolve CVE-2026-22036

[ryancragun]

How to read this pull request

Upgrade the following packages to remove a transitive dependency on undici < 6.23.0:

• @actions/core => ^3.0.0
• @actions/exec => ^3.0.0
• @actions/http-client => ^4.0.0
• @actions/tool-cache => ^4.0.0

Since I was upgrading these outdated packages I also took the time to upgrade other outdated packages to the latest:

• globals => ^17.3.0
• vitest => ^4.0.18

Upgrading our dep modules to ESM required refactoring some of our vitest tests. Spying properties changed with ESM imports so I had to make some changes there.

We also bump to v1.5 since so many of our dependencies changed.

Resolves: GHSA-g9mf-h72j-4rw9

Checklist

• The commit message includes an explanation of the changes
• Manual validation of the changes have been performed (if possible)
• New or modified code has requisite test coverage (if possible)
• I have performed a self-review of the changes
• I have made necessary changes and/or pull requests for documentation
• I have written useful comments in the code

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.
• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
• If applicable, I've documented the impact of any changes to security controls.