Fix CVEs by updating axios to patched versions

[sbouchet]

What does this PR do?

This PR fixes CVE-2025-62718 and CVE-2026-40175.

axios version is updated to 1.15.0

What issues does this PR fix?

https://redhat.atlassian.net/browse/CRW-10707
https://redhat.atlassian.net/browse/CRW-10709
https://redhat.atlassian.net/browse/CRW-10691
https://redhat.atlassian.net/browse/CRW-10693
https://redhat.atlassian.net/browse/CRW-10695

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

• the PR contains changes in the code folder (you can skip it if your changes are placed in a che extension )
• the corresponding items were added to the CHANGELOG.md file
• rules for automatic git rebase were added to the .rebase folder

[github-actions]

Click here to review and test in web IDE:

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-684-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-684-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-684-dev-amd64

[rgrunber]

This change eliminates :

che-api

axios  <=1.14.0
Severity: critical
Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL - https://github.com/advisories/GHSA-jr5f-v2jv-69x6
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig - https://github.com/advisories/GHSA-43fc-jf86-j433
Axios has a NO_PROXY Hostname Normalization Bypass Leads to SSRF - https://github.com/advisories/GHSA-3p68-rc4w-qgx5
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain - https://github.com/advisories/GHSA-fvcv-3m26-pcqx
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain - https://github.com/advisories/GHSA-fvcv-3m26-pcqx
fix available via `npm audit fix --force`
Will install undefined@undefined, which is a breaking change
node_modules/@eclipse-che/workspace-telemetry-client/node_modules/axios
node_modules/axios
  @eclipse-che/workspace-telemetry-client  *
  Depends on vulnerable versions of axios
  node_modules/@eclipse-che/workspace-telemetry-client

che-remote

axios  <=1.14.0
Severity: critical
Axios has a NO_PROXY Hostname Normalization Bypass Leads to SSRF - https://github.com/advisories/GHSA-3p68-rc4w-qgx5
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain - https://github.com/advisories/GHSA-fvcv-3m26-pcqx
fix available via `npm audit fix`
node_modules/axios

[RomanNikitenko]

This change forces the telemetry client's axios@^0.24.0 to resolve to 1.15.0
Overriding from Axios 0.24.0 to 1.15.0 is a significant version change and may introduce breaking changes(error types, FormData handling)

Please check if 0.31.0 can be used instead.

[RomanNikitenko]

please see #684 (comment)