Update dependencies and CDK; resolve npm audit advisories

[pcholakov]

General dependency tidy-up: update CDK and the dev toolchain, and resolve the actionable npm audit advisories.

Updates

• aws-cdk-lib 2.236.0 -> 2.260.0, aws-cdk CLI -> 2.1128.0, constructs -> 10.6.0
• @aws-sdk/client-secrets-manager -> 3.1072.0, @restatedev/restate-sdk -> 1.14.5
• Dev toolchain to latest in-range: @types/*, prettier, ts-jest, tsx, typescript, jest-cdk-snapshot
• package.json floors bumped to match; no major-version bumps

Security (npm audit)

Before: 30 (1 critical, 4 high, 24 moderate, 1 low) -> After: 21 (0 critical, 0 high, 20 moderate, 1 low)

• Critical fast-xml-parser (DoS) cleared via the AWS SDK update
• All 4 high cleared: aws-cdk-lib NodejsFunction command injection, fast-uri, minimatch, picomatch (ReDoS)

The remaining 20 moderate + 1 low are dev-only and not installed by consumers of the published library (devDependencies):

• 20 moderate root in js-yaml@3, pinned by jest@29's coverage tooling (@istanbuljs/load-nyc-config) and by jest-cdk-snapshot. A jest 29->30 bump does not reduce the count (the js-yaml@3 pins persist), and a blanket js-yaml@4 override breaks jest-cdk-snapshot (it uses the removed v3 safeLoad API). These need upstream fixes.
• 1 low is esbuild's Windows dev-server file-read advisory; the dev server is not used here.

Tests

• npm run build, npm run lint, npm test all pass
• Snapshots regenerated: the test fixture uses Runtime.NODEJS_LATEST, which resolves to nodejs24.x under CDK 2.260 (was nodejs22.x). Construct-owned handlers remain pinned at NODEJS_22_X - no consumer-facing change.

Note

Overlaps with #101 (Release 1.7.0) in package.json / package-lock.json. Whichever merges first, the other should be rebased.