chore: fix dependabot alerts

[jonathannorris]

Summary

• Bump semantic-release from ^19 to ^24 — v24 pulls in @semantic-release/npm@12 which depends on npm@10, resolving bundled vulnerable versions of tar and minimatch
• Add overrides for handlebars >= 4.7.9, picomatch >= 2.3.2, flatted >= 3.4.2, and glob-promise >= 6.0.7 to force patched transitive deps
• glob-promise >= 6.0.7 drops the npm-install-peers dependency that was pulling in npm@6 with bundled vulnerable tar and minimatch

Resolves all 14 open Dependabot alerts (#90, #91, #93, #94, #95, #97, #99, #101, #102, #103, #105, #106, #108, #109).

[Copilot]

Pull request overview

This PR addresses Dependabot security alerts by updating release tooling and forcing patched transitive dependency versions via npm overrides.

Changes:

• Bump semantic-release from ^19 to ^24.2.9.
• Add npm overrides to require patched versions of handlebars, picomatch, flatted, and glob-promise.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

semantic-release@24 requires Node >=20.8.1 (see package-lock). Since the repo now pins CI to Node 20, consider also adding an engines.node constraint (and/or documenting it) in package.json so local installs/runs on older Node versions fail fast with a clear message rather than breaking at release time.