LTS-4004: bump form-data to patched releases (4.0.6, 2.5.6)

Fixes CRLF injection in form-data via unescaped multipart field names and filenames (GHSA-hmw2-7cc7-3qxx, CWE-93, CVSS 7.5).

form-data is a transitive dev-dependency; both vulnerable copies bumped within existing semver ranges: top-level 4.0.4 -> 4.0.6 and 2.5.5 -> 2.5.6 (under @types/request). Lockfile-only; package.json untouched.

npm v11 also reconciled a stale puppeteer-core optional-peer subtree (optional peer of webdriverio, unused by this sample) that was lingering in the lockfile; npm ci produces the same tree. No direct deps lost; no hard dep on puppeteer-core remains.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: prasadthx