Pin serialize-javascript to ^7.0.3 via overrides to fix high-severity RCE

[Copilot]

serialize-javascript <=7.0.2 has a high-severity RCE vulnerability (GHSA-5c6j-r48x-rmvq) pulled in transitively via mocha. Since mocha doesn't yet declare a compatible direct dependency, an npm override is required to force resolution.

Changes

• package.json: Added overrides entry pinning serialize-javascript to ^7.0.3
• package-lock.json: Updated via npm audit fix (no --force); serialize-javascript now resolves to 7.0.4

"overrides": {
  "serialize-javascript": "^7.0.3"
}

The remaining 2 low-severity advisories (diff/mocha) require a breaking mocha downgrade to resolve and are not addressed here.