fix(deps): override immutable 4.3.9 in /templates

[dependabot]

Why

The original immutable 3.8.2 -> 3.8.3 bump addressed Dependabot alert #66, but it is no longer sufficient: alerts #118 (GHSA-v56q-mh7h-f735) and #120 (GHSA-xvcm-6775-5m9r) affect every Immutable release below 4.3.9.

browser-sync 3.0.4 and browser-sync-ui 3.0.4 both declare immutable: ^3, and there is no patched 3.x release for the newer advisories.

Change

• Add scoped npm overrides that force only BrowserSync and its UI to Immutable 4.3.9, the smallest release patched for all three alerts.
• Regenerate templates/package-lock.json through npm rather than editing it by hand.
• Keep Sass and Sass Embedded on their supported Immutable 5.1.9 dependency line.
• Merge the latest main; the PR diff remains limited to the template package manifest and lockfile, with no Bootstrap changes.

This crosses BrowserSync's declared Immutable major-version range, so the compatibility risk is non-zero. The scope is deliberately limited to the two BrowserSync consumers, whose used APIs (Map, List, OrderedSet, fromJS, is, and merge/get operations) remain available in 4.3.9. A live BrowserSync/UI startup smoke test exercises the Immutable-backed config path and confirms an HTTP response before clean shutdown.

Security result

• Resolves open high-severity Immutable alerts Add copyright and license info to output files #66, Typo #118, and Provide a way to remove the "improve this doc" button #120.
• The lockfile contains BrowserSync/UI Immutable 4.3.9 and Sass Immutable 5.1.9 only; no vulnerable Immutable instance remains.
• npm audit reports no Immutable finding and zero high/critical vulnerabilities. Two unrelated findings remain (one low and one moderate).

Validation

• npm test
• npm run lint
• npm run build
• BrowserSync/UI Immutable config startup and HTTP smoke check
• npm audit --registry=https://packagefeedproxy.microsoft.io/npm/

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[vicancy]

Closing as superseded by #11139, which brought Immutable 3.8.4 into main without crossing BrowserSync's declared major-version range.

The advisories have since been updated with a patched 3.x release: both GHSA-v56q-mh7h-f735 and GHSA-xvcm-6775-5m9r list 3.8.4 as fixed for the 3.x line. The corresponding repository alerts are now marked fixed. Current main resolves BrowserSync's Immutable to 3.8.4 and retains Sass/Sass Embedded on 5.1.9.

The description's earlier statement that no patched 3.x release exists is therefore no longer current. The forced 4.3.9 overrides are unnecessary for these fixes and would add avoidable compatibility risk.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.