[security]: upgrade vulnerable undici dependency

[pitimon]

Security finding

Current npm audit --json reports the direct production dependency undici as high severity with a fix available.

Current vulnerable range in the lockfile: 7.0.0 - 7.28.0.

Affected advisories include:

• GHSA-vmh5-mc38-953g — TLS certificate validation bypass in SOCKS5 ProxyAgent
• GHSA-vxpw-j846-p89q — WebSocket fragment-count DoS
• GHSA-hm92-r4w5-c3mj — cross-origin routing via SOCKS5 proxy pool reuse
• GHSA-4cwx-7wf7-3272 — cache information disclosure / parse-time crash
• additional moderate/low Undici advisories

Later advisories require at least 7.29.0 for remediation.

Expected

• Upgrade undici to a non-vulnerable release supported by the project runtime.
• Run focused outbound/proxy/redirect/body-limit tests and full ci:local.
• Confirm npm audit no longer reports the vulnerability.

This dependency finding pre-existed PR #162 and was not introduced by the Goose fix.