Bump bcryptjs from 2.4.3 to 3.0.3

[rugpanov]

Why

Replaces Dependabot's #1937, which bumped package.json without regenerating the lockfile (Yarn Berry YN0028 failure). bcryptjs is used at runtime in telemetry (src/telemetry/index.ts) to hash the username into user.hashedUserName, so the critical requirement is that v3 produces the same hash as v2 for a given (input, salt) — otherwise telemetry identity would silently change.

What

• Bump bcryptjs → ^3.0.3 via yarn up; regenerated yarn.lock.
• Remove the now-redundant @types/bcryptjs devDependency — bcryptjs 3 ships its own type definitions (umd/index.d.ts), so the separate @types package is obsolete. Build type-checks cleanly on the bundled types.

Verification

• Hash stability confirmed: bcrypt.hash("testuser@example.com", "$2b$07$" + salt) produces the byte-identical output under v2 and v3.
• Telemetry unit test passes — src/telemetry/index.test.ts asserts an exact hardcoded user.hashedUserName bcrypt hash; full unit suite green (274 passing).
• require("bcryptjs") resolves fine — v3 is ESM-only but ships a UMD entry, so the esbuild CJS bundle is unaffected.
• yarn install --immutable, yarn run build, and eslint all pass.

Backward compatibility: hash output is identical to v2, so existing user.hashedUserName telemetry values remain consistent. No API/state/config change.

Closes #1937.

This pull request and its description were written by Isaac.

[rugpanov]

🤖 Integration tests ❌ 7 of 35 test jobs failed for 765e0b1c (28 passed).
View run

[github-actions]

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/vscode

Inputs:

• PR number: 1960
• Commit SHA: 5e0c0eb0276fab4f1bf3114c6ed06192525bb275

Checks will be approved automatically on success.

[rugpanov]

🤖 Integration tests ❌ 5 of 35 test jobs failed for 5e0c0eb0 (30 passed).
View run