fix: resolve high-severity npm audit vulnerability (basic-ftp)

npm audit fix updates basic-ftp 5.2.0 → 5.2.2 to resolve:
- GHSA-6v7q-wjvx-w8wg: Incomplete CRLF Injection Protection
- GHSA-chqc-8p9q-pq6q: FTP Command Injection via CRLF

basic-ftp is a deep transitive dependency through
@lhci/cli → proxy-agent → pac-proxy-agent → get-uri → basic-ftp.

After the fix: 0 vulnerabilities.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: raifdmueller