chore: upgrade to CDS 10, patch security vulns (#1546)

Bumps the whole CAP stack to v10 and fixes a batch of npm audit issues.
All README commands pass locally (npm ci, cds watch, npm run build:ui,
  mbt build, npm test).

  CAP stack
  - @sap/cds + @sap/cds-dk → 10
  - @cap-js/hana + @cap-js/sqlite → 3
  - @cap-js/cds-test → 1, @cap-js/cds-typer + @cap-js/cds-types → latest

  Security
- @sap/ux-specification → UI5-1.144 (latest), express → 4.22.2,
ui5-middleware-simpleproxy → 3.8.0 — these alone collapse most of the
vuln chain
- @sap/cds-dk → 9.9.3 keeps ws patched; remaining 9 vulns are all
@ui5/project → pacote → sigstore (dev toolchain only, no upstream fix
available yet)

  Test fixes
- CDS 10 defaults ieee754compatible: true — decimals now serialise as
strings (900 → '900.000'). Removed the stale IEEE754Compatible
content-type header and updated all numeric assertions to match.
- Minor type annotations (url: string, expectedValue: string, non-null
assertion on travel)

  Build fixes
- @ui5/cli was silently de-hoisted to workspace-local installs, breaking
ui5-tooling-transpile during mbt build. Added it to root
devDependencies.
- axios needs to be an explicit dep — @cap-js/cds-types 0.18 references
import('axios') for type declarations even though cds-test 1.x emulates
it at runtime.
  
  CI fixes (follow-up)

  Three failures on the first CI run:

- Node 20 dropped — CDS 10 requires Node ≥22. Removed 20.x from the
matrix, bumped engines.node to >=22, added 24.x to ci matrix
- karma startup crash on Node 22 — ui5-middleware-simpleproxy 3.8.0
(upgraded for the http-proxy-middleware security fix) pulls in minimatch
10.x → brace-expansion 5.x which gets hoisted to root. karma → minimatch
3.x then loads brace-expansion as a direct function call — an API that
5.x dropped. Fixed by pinning brace-expansion 1.x and balanced-match 1.x
as nested lock entries under karma/minimatch/. Not fixable via overrides
since npm won't create 3-level-deep nesting automatically.
- Java CI npm ci failing with missing @esbuild/linux-* — npm install on
macOS only writes the current platform's optional deps to the lockfile.
Added local .npmrc with os=any cpu=any so every npm install produces a
cross-platform lockfile going forward - npmrc is gitignored, so the fix
is local only.

Author: mikicvi-SAP

.github/workflows/node.js.yml

@@ -6,10 +6,10 @@ name: Node.js CI
 on:
   workflow_dispatch:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
-    types: [ labeled, opened, synchronize, reopened ]
+    branches: [main]
+    types: [labeled, opened, synchronize, reopened]
   schedule:
     - cron: 20 4 * * *
 
@@ -22,31 +22,31 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [22.x, 20.x]
+        node-version: [24.x, 22.x]
 
     steps:
-    - uses: actions/checkout@v4
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v4
-      with:
-        node-version: ${{ matrix.node-version }}
-    - run: npm i -g @sap/cds-dk typescript tsx
-    - run: npm ci
-    - run: npx cds-typer "*"
-    - run: npm run lint
-    - run: npm run build --if-present
-    - run: npm run test
-    - run: npm run test:mocha
+      - uses: actions/checkout@v4
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+      - run: npm i -g @sap/cds-dk typescript tsx
+      - run: npm ci
+      - run: npx cds-typer "*"
+      - run: npm run lint
+      - run: npm run build --if-present
+      - run: npm run test
+      - run: npm run test:mocha
 
-    - name: Run integration tests - Manage Travels
-      working-directory: ./app/travel_processor
-      run: |
-        npm run test:node -- --ci
+      - name: Run integration tests - Manage Travels
+        working-directory: ./app/travel_processor
+        run: |
+          npm run test:node -- --ci
 
-    - name: Run integration tests - Analyze Bookings
-      working-directory: ./app/travel_analytics
-      run: |
-        npm run test:node -- --ci
+      - name: Run integration tests - Analyze Bookings
+        working-directory: ./app/travel_analytics
+        run: |
+          npm run test:node -- --ci
 
 #
 ### temporarily switch off deployment as it consistently fails