fix: update tootallnate once to resolve CVE-2026-3449

[dannyneira]

Summary

• Adds an npm overrides entry to force transitive @tootallnate/once to 2.0.1.
• Updates package-lock.json so the http-proxy-agent transitive edge resolves to the patched version.

Vulnerability

• Advisory: GHSA-vpq2-c234-7xj6
• CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-3449
• Dependabot alert: https://github.com/warpdotdev/generate-changelog/security/dependabot/63
• Package: @tootallnate/once
• Dependency relationship: transitive development dependency via http-proxy-agent
• Vulnerable range: < 2.0.1
• Patched version: 2.0.1

Verification

• npm audit --json no longer reports @tootallnate/once.
• npm ci --ignore-scripts
• npm run build
• npm run lint

Conversation: https://staging.warp.dev/conversation/e93e8d7f-1c80-4ad0-bf10-97b7e3565da6
Run: https://oz.staging.warp.dev/runs/019e506a-4de1-7057-bb36-627c8c3c656b
This PR was generated with Oz.