chore(deps): bump istanbul-mocha dependencies to resolve Dependabot alerts

Regenerate the istanbul-mocha lockfile and pin transitive dependencies via
npm overrides so every package flagged by Dependabot resolves to a patched
version. Also bumps mocha and codecov. Clears all 31 open security alerts
(js-yaml, uuid, @tootallnate/once, lodash, handlebars, minimatch, node-fetch,
minimist, async).

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: thomasrockhu-codecov