fix(entraid): bump @azure/msal-node to 5.x to drop vulnerable uuid

[nkaradzhov]

(CVE-2026-41907)

The uuid@8.3.2 dependency in @azure/msal-node 2.x and 3.x is impacted by CVE-2026-41907 (CVSS 9.8). @azure/msal-node 5.1.5 replaces uuid with node:crypto. @azure/identity 4.13.1 also moves to msal-node 5.x, closing the second transitive chain to uuid. Both upgrades require Node.js >= 20, so bump engines.node across all packages and drop Node 18 from the test matrix.

Refs: #3268, GHSA-6mrv-vw7r-r73q

Description

Describe your pull request here

---

Checklist

• Does npm test pass with this change (including linting)?
• Is the new or changed code fully tested?
• Is a documentation update included (if this change modifies existing APIs, or introduces new ones)?

---

Note

Medium Risk
Upgrades @azure/identity/@azure/msal-node across @redis/entraid to remove a vulnerable transitive uuid dependency and introduces a breaking runtime requirement (Node.js >=20), which could impact consumers or CI environments still on Node 18.

Overview
Updates @redis/entraid to use @azure/identity@4.13.1 and @azure/msal-node@5.x (plus @azure/msal-common) to drop the vulnerable transitive uuid chain, with corresponding package-lock.json updates.

Raises engines.node to >=20 across all published packages and removes Node 18 from the GitHub Actions test matrix (tests.yml).

^{Reviewed by Cursor Bugbot for commit 435cf36. Bugbot is set up for automated code reviews on this repo. Configure here.}