Fix Dependabot security alerts across JavaScript samples

[vicancy]

Summary

Resolves all 45 open Dependabot vulnerability alerts (1 critical, 14 high, 27 moderate, 3 low) across the four JavaScript sample projects. After these changes, npm audit reports 0 vulnerabilities in every affected project.

The alerts were all in transitive dependencies, so each project needed a different, targeted approach rather than a simple version bump.

Changes per project

samples/EventGridIntegration/javascript

Migrated from the deprecated azure-storage package to @azure/data-tables.

azure-storage depends on the deprecated request package, whose SSRF advisory (GHSA-p8p7-x288-28g6) has no patched version — so the only way to clear it (and the related form-data, qs, tough-cookie, uuid, xml2js alerts) was to stop using azure-storage. OnConnection/index.js was rewritten to use @azure/data-tables:

• createTableIfNotExists → createTable() (idempotent, cached per process)
• retrieveEntity / insertEntity / replaceEntity → getEntity / createEntity / updateEntity
• The optimistic-concurrency retry loop is preserved by passing the entity's etag to updateEntity(..., 'Replace', { etag }).

The AZURE_STORAGE_CONNECTION_STRING setting is unchanged, so no configuration changes are required.

samples/QuickStartServerless/javascript/v4-programming-model

• Removed the azurite devDependency. Azurite is a local-only storage emulator that drags in a large, perpetually-vulnerable transitive tree (axios, uuid, @azure/identity, tough-cookie, xml2js, tedious, applicationinsights, …) at every published version. The sample's runtime code never imports it.
• The start:azurite script now runs it on demand via npx --yes azurite …, preserving the one-command workflow without committing the vulnerable tree to the lockfile (matches how the sibling C# samples document Azurite). README updated accordingly.
• Bumped azure-functions-core-tools to ^4.12.0.

samples/ServerlessChatWithAuth/v4-model

Bumped azure-functions-core-tools to ^4.12.0. Older builds bundled vulnerable minimatch, debug, and brace-expansion (which can't be fixed via overrides because they ship inside the package tarball); 4.12.0 uses caret-ranged, patched dependencies.

samples/Whiteboard/MCPServer

Refreshed the lockfile via npm audit fix, bumping @modelcontextprotocol/sdk (→ 1.29.0), hono, fast-uri, qs, and ws to patched versions.

Verification

• npm audit → 0 vulnerabilities in all four projects.
• node --check passes for the modified EventGridIntegration function files.
• The migrated OnConnection module loads and parses a connection string cleanly.

Note: node_modules is gitignored; only package.json, package-lock.json, source, and README files are changed.