fix(security): force serverless's tar to >=7.5.8 (CVE-2026-26960)

serverless@3.40.0 pulled tar@6.2.1, source of 7 high-severity node-tar
extraction advisories fixed only on the 7.5.8+ line. Scoped override
bumps it to tar@7.5.19. tar is a devDependency only, so consumers were
never exposed.

Fixes #188

Author: sid88in

package-lock.json

@@ -55,6 +55,9 @@
     },
     "ajv-merge-patch": {
       "fast-json-patch": "3.1.1"
+    },
+    "serverless": {
+      "tar": "^7.5.8"
     }
   },
   "dependencies": {