build(deps): bump dependencies and migrate to ESLint 10 flat config (#544)

Bump all safe dependencies to latest major versions:
- @cyclonedx/cyclonedx-library 6→10, https-proxy-agent 7→9, p-limit 4→7
- chai 4→6, mocha 10→11, sinon 15→22, sinon-chai 3→4
- eslint 8→10, typescript 5→6, which 5→7, @types/node 20→25

Migrate ESLint configuration:
- Convert .eslintrc.json to eslint.config.js (flat config, required by ESLint 10)
- Replace eslint-plugin-import with eslint-plugin-import-x (ESLint 10 support)
- Replace eslint-plugin-editorconfig with equivalent built-in ESLint rules
  (plugin uses removed context.getFilename API incompatible with ESLint 10)

Fix Mocha 11 breaking change:
- Convert all suite().beforeAll().afterAll() chains to use
  suiteSetup()/suiteTeardown() inside suite callbacks (chaining API removed)

Add dependabot ignore for packageurl-js (blocked on upstream purl spec
issue for '+' encoding in versions, see package-url/packageurl-js#90).

Closes #542

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: Strum355

.eslintrc.json

@@ -9,6 +9,10 @@ updates:
     exclude-paths:
       - "test/providers/tst_manifests/**"
       - "test/providers/provider_manifests/**"
+    ignore:
+      # Blocked on upstream purl spec issue for '+' encoding in versions.
+      # See: https://github.com/package-url/packageurl-js/pull/90
+      - dependency-name: "packageurl-js"
     groups:
       npm-dependencies:
         patterns:

.github/dependabot.yml

@@ -0,0 +1,54 @@
+import js from "@eslint/js";
+import importPlugin from "eslint-plugin-import-x";
+import globals from "globals";
+
+export default [
+	js.configs.recommended,
+	{
+		plugins: {
+			"import-x": importPlugin,
+		},
+		languageOptions: {
+			ecmaVersion: 2022,
+			sourceType: "module",
+			globals: {
+				...globals.node,
+				...globals.mocha,
+				...globals.es2021,
+			},
+		},
+		rules: {
+			...importPlugin.configs.recommended.rules,
+			"no-unused-vars": ["error", { "caughtErrors": "none" }],
+			"preserve-caught-error": "off",
+			// editorconfig enforcement (replaces eslint-plugin-editorconfig)
+			"eol-last": ["error", "always"],
+			"indent": ["error", "tab"],
+			"linebreak-style": ["error", "unix"],
+			"no-trailing-spaces": "error",
+			"unicode-bom": ["error", "never"],
+			"curly": "warn",
+			"eqeqeq": ["warn", "always", {"null": "never"}],
+			"no-throw-literal": "warn",
+			"import-x/order": ["warn", {
+				"groups": ["builtin", "external", "internal", "parent", "sibling", "index"],
+				"newlines-between": "always",
+				"alphabetize": {
+					"order": "asc",
+					"caseInsensitive": true,
+				},
+			}],
+		},
+		settings: {
+			"typescript": {},
+			"import-x/resolver": {
+				"typescript": {
+					"extensions": [".js"],
+				},
+			},
+		},
+	},
+	{
+		ignores: ["index.js", "dist/**"],
+	},
+];