deps: Bump js-releases to 1.7.0

[radeksimko]

This also updates a transitive dependency openpgp to 5.10.1, which should in turn address GHSA-ch3c-v47x-4pgp

While this was flagged as security alert my understanding is that it doesn't impact us (or our users) in any way, because js-releases does not use readCleartextMessage nor verifyCleartextMessage as per https://github.com/hashicorp/js-releases/blob/6b64ff2a17be14820d7cdef5fad8d45645e83a80/src/index.ts#L215-L231

[dbanck]

And it shouldn't affect users, because we use js-releases at build time to bundle the language server and don't ship it with the final extension.

[dbanck]

The test failure is strange, though

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.