Fix dependency vulnerabilities, JWT token persistence and security scanning

[williajm]

Pasting a JWT previously saved the entire bearer token in the URL fragment, making it available in copied links and browser history. JWT tokens and verification keys now stay in memory and clear on reload. Opening an old JWT share link removes its fragment without restoring the token.

This also resolves the open dependency advisories and adds the missing code-scanning coverage:

• Upgrade Faker from 9.9.0 to 10.6.0 in the lockfile, with a minimum of 10.5.0, fixing GHSA-qxc2-j82w-r537.
• Upgrade Vitest, its mocker and the matching coverage provider to 5.0.1, fixing GHSA-82fw-gwwq-j7x9.
• Add CodeQL security-extended scans for JavaScript/TypeScript and GitHub Actions on PRs, main pushes and a weekly schedule. Actions are pinned to commits and upload permissions are scoped to the analysis job.
• Add browser regressions for decoding and verification without credential persistence, reload clearing, and removal of legacy fragments during initial and same-document navigation. Document the JWT sharing change.

Validation: npm audit reports zero vulnerabilities; all 597 unit tests pass with V8 coverage; typecheck and the production build pass; all 67 Chromium end-to-end tests pass; generated pages match the registry.

Includes the dependency fixes covered by #14 and #15. Existing JWT share links intentionally stop restoring tokens. Previously copied links and older browser-history entries cannot be revoked by this change.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.