Fix audit vulnerabilities and Puppeteer WDAC block on managed dev machines

[Hector Hernandez (hectorhdzg)]

Security (package-lock.json):

• Apply non-breaking npm audit fix (24 -> 17 vulnerabilities); resolves brace-expansion, fast-uri, morgan and shell-quote advisories.
• Normalize lockfile resolved URLs back to https://registry.npmjs.org/ so external contributors and public CI are not pinned to an internal npm mirror.
• Remaining advisories are dev-only, transitively pinned by react-native@0.69 (jscodeshift/micromatch/braces, ip, image-size, metro, react-devtools-core) and would require a breaking react-native major upgrade, so they are left as-is.

Puppeteer (gruntfile.js):

• Add a CI-gated helper that resolves the QUnit browser test executable to a locally installed Edge when available, avoiding the Windows "blocked by IT admin" (Defender/WDAC) popup triggered by Puppeteer's unsigned bundled Chromium on managed developer machines.
• Honors PUPPETEER_EXECUTABLE_PATH first and returns undefined on CI/official builds (TF_BUILD/CI/BUILD_BUILDID) so bundled Chromium behavior is unchanged.
• Wire executablePath into both puppeteer test blocks.