Fix critical npm dependency alerts

[lancewillett]

Summary

• Add targeted npm overrides for patched basic-ftp and handlebars releases.
• Refresh package-lock.json so the current Dependabot critical alerts resolve to patched versions.
• Leave the existing high, medium, and low alert backlog for a separate pass.

Validation

• npm ci
• npm ls handlebars basic-ftp --all
• npm audit --audit-level=critical
• npm run lint
• npm run build
• npm test
• git diff --check

Notes

• Dependabot alerts are now enabled for this repository.
• Dependabot security updates remain disabled; this PR only addresses the critical alerts found after enabling alerts.

[github-actions]

👋 Thanks for your interest in contributing to Newspack!

Newspack development has moved to a single monorepo: Automattic/newspack-workspace. This repository is now a read-only mirror, so we're automatically closing new pull requests here.

Please reopen your change against the monorepo – newspack-network now lives at plugins/newspack-network/ there. Thank you! 💙