Fix security vulnerabilities (#767)

* fix: resolve npm audit vulnerabilities, refresh license cache, rebuild dist

- npm audit fix resolves brace-expansion (high), fast-xml-parser (high),
  and undici (moderate) advisories via transitive dependency updates
- Regenerated .licenses/npm cache to match updated dependency tree
- Rebuilt dist/setup and dist/cache-save bundles

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: sync vendored install-dotnet.ps1 with upstream dot.net script

Basic Validation was failing because the vendored copy of
externals/install-dotnet.ps1 was out of date compared to the live
script served from https://dot.net/v1/dotnet-install.ps1, which
installation-scripts.test.ts compares against on every run.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.licenses/npm/is-unsafe.dep.yml

@@ -1,10 +1,10 @@
 ---
 name: is-unsafe
-version: 1.0.1
+version: 2.0.0
 type: npm
 summary: Zero-dependency, DOM-free, pure predicate for detecting unsafe strings across
   HTML, XML, SVG, SQL, SHELL, and REGEX contexts
-homepage: 
+homepage:
 license: mit
 licenses:
 - sources: LICENSE