chore: use lock for action + update outdated deps

[alexander-akait]

Summary

What kind of change does this PR introduce?

Did you add tests for your changes?

Does this PR introduce a breaking change?

If relevant, what needs to be documented once your changes are merged or what have you already documented?

Use of AI

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.28%. Comparing base (041561f) to head (9913cf5).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #463   +/-   ##
=======================================
  Coverage   95.28%   95.28%           
=======================================
  Files           2        2           
  Lines         996      996           
=======================================
  Hits          949      949           
  Misses         47       47           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR updates repository maintenance tooling by bumping several devDependencies and hard-pinning GitHub Actions to specific commit SHAs for supply-chain safety.

Changes:

• Bumped devDependencies: cspell, del, del-cli, and lint-staged (and refreshed package-lock.json accordingly).
• Pinned actions/checkout, actions/setup-node, actions/dependency-review-action, and codecov/codecov-action to exact SHAs in CI workflows.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
package.json	Updates devDependency versions (cspell/del/del-cli/lint-staged).
package-lock.json	Regenerates lockfile to reflect updated tooling versions and transitive deps.
.github/workflows/nodejs.yml	Pins core CI actions (checkout/setup-node/codecov) to SHAs.
.github/workflows/dependency-review.yml	Pins checkout and dependency-review actions to SHAs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.