feat: use serde to build package json and check npm package name

[mootz12]

What

Use serde to modify package.json file during typescript binding generation. And check that the npm package name is valid.

Why

Fixes the issue where users can create invalid package.json files

Known limitations

None

[Copilot]

Pull request overview

This PR hardens TypeScript bindings project generation by validating the generated npm package name and updating package.json via JSON parsing/serialization (instead of raw string replacement) to prevent invalid or injectable package.json output.

Changes:

• Add validate_npm_package_name (with tests) to enforce npm naming rules, including scoped names.
• Validate the --output-dir basename / contract name before generating the TS bindings project.
• Update TS project template handling to set package.json.name through serde_json, enabling preserve_order.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
cmd/soroban-cli/src/commands/contract/bindings/typescript.rs	Validates --output-dir basename as an npm package name and introduces a new CLI error variant.
cmd/crates/soroban-spec-typescript/src/lib.rs	Adds npm package name validation helper and unit tests.
cmd/crates/soroban-spec-typescript/src/boilerplate.rs	Switches package.json update to serde_json parsing/serialization; adds tests for name setting and invalid input.
cmd/crates/soroban-spec-typescript/Cargo.toml	Enables serde_json’s preserve_order feature to keep template key ordering stable.
Cargo.lock	Updates lockfile to include new transitive dependency introduced by preserve_order.