fix(deps): patch basic-ftp, fast-uri, fast-xml-builder + bump to 1.2.21

Resolves three transitive security advisories surfaced via Dependabot:
- basic-ftp 5.3.0 -> 5.3.1 (GHSA-rpmf-866q-6p89 — client-side DoS via unbounded multiline control response, PMAA-113)
- fast-uri 3.1.0 -> 3.1.2 (GHSA-q3j6-qgpj-74h6 — path traversal via percent-encoded dot segments, PMAA-114)
- fast-xml-builder 1.1.5 -> 1.2.0 (GHSA-5wm8-gmm8-39j9 — attribute-quote escape allowing injected attributes)

Lockfile regenerated from scratch (`rm package-lock.json && npm install`) so all transitive deps land on registry-current versions; npm audit reports 0 vulnerabilities.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: manoj-k04