SEC-2309: patch form-data to 4.0.6 (CVE-2025-7501)

[himynameisang]

https://simondata.atlassian.net/browse/SECURITY-2309

Summary

• Bumps form-data from 4.0.2 → 4.0.6 via npm update, resolving ORCA-8368351 (CVE-2025-7501). The patched version is sourced from the JFrog registry which has 4.0.6 available.
• Switches Dockerfile from npm install to npm ci so future Docker builds fail fast if the lock file is ever missing or inconsistent, rather than silently re-resolving to a potentially vulnerable version.

Test plan

• Verify npm audit no longer flags form-data after this change
• Confirm Docker build succeeds with npm ci
• Confirm Orca scan clears ORCA-8368351

🤖 Generated with Claude Code

[orca-security-us]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

[Copilot]

Pull request overview

This PR addresses a security finding by updating the transitive form-data dependency to a patched release and tightening Docker build reproducibility by using npm ci instead of npm install.

Changes:

• Updated form-data from 4.0.2 to 4.0.6 in package-lock.json (including associated dependency updates like hasown and mime-types).
• Changed the Docker build dependency install step from npm install to npm ci to enforce lockfile consistency during image builds.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package-lock.json	Bumps form-data to 4.0.6 (and updates related transitive deps) to address CVE-2025-7501.
Dockerfile	Switches dependency installation to npm ci to ensure deterministic installs and fail fast on lockfile issues.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.