fix: Upgrade to latest version of graphql-codegen cli

[JustinRatner]

Summary

From Brad Bunce

We're seeing 13 high-severity npm audit findings when using @LaunchDarkly/observability-node@1.1.0. They all trace back to lodash@4.17.21 pulled in through the @graphql-codegen/cli dependency chain:

@LaunchDarkly/observability-node
  → @graphql-codegen/cli
    → @graphql-codegen/plugin-helpers
      → lodash <=4.17.23
The specific lodash advisories are:

GHSA-r5fr-rjxr-66jc — Code injection via _.template
GHSA-f23m-r3pf-42rh — Prototype pollution via _.unset / _.omit
GHSA-xxjr-mmjv-4gpg — Prototype pollution in _.unset / _.omit
npm audit fix can't resolve these without downgrading @LaunchDarkly/observability-node to 0.1.0, which is a breaking change. The only consumer-side workaround is an overrides entry to force a patched lodash version, which carries compatibility risk.

Could the @graphql-codegen dependencies in the observability-node package be updated to versions that no longer depend on vulnerable lodash? Appreciate any timeline or workaround guidance you can share.

The latest version of graphql-codegen cli removed lodash as an unnecessary dependency.

How did you test this change?

Ran codegen of observability-node successfully

---

Note

Low Risk
Low risk because changes are confined to dev/build tooling (graphql-codegen) and lockfile updates, with no production runtime code modifications.

Overview
Upgrades @graphql-codegen/cli from ^5.0.7 to ^6.3.1 for both @launchdarkly/observability-node and @launchdarkly/observability-shared, and moves it out of observability-node runtime dependencies into devDependencies.

Regenerates yarn.lock to reflect the new codegen dependency tree (notably updating related @graphql-codegen/*, @graphql-tools/*, and @babel/* packages).

^{Reviewed by Cursor Bugbot for commit 425f432. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Vadman97]

@JustinRatner might need to run a yarn dedupe