Sweep dependencies and bump to 2.7.11 (#87)

## Summary

Dependency sweep for node-sdk, plus the release bump to 2.7.11.

- The osv-scanner binary the Dependency Scan job downloads moves from
v2.5.1 to v2.6.0. That pin is a workflow input, so dependabot never
proposes it.
- Version 2.7.10 to 2.7.11, which picks up the dev-tooling bumps merged
in #86 (`@types/node`, `knip`, `typescript-eslint`) at release time. The
SDK has no runtime dependencies, so nothing a consumer installs changes.

Checked and found current: every GitHub Action is on a release-tag major
and that major is upstream's latest (`actions/checkout@v7` at v7.0.1,
`actions/setup-node@v7` at v7.0.0, `actions/cache@v6` at v6.1.0,
`oven-sh/setup-bun@v2` at v2.2.0, `useblacksmith/checkout@v1` at
v1.7.0), with no branch refs and no exact pins; no Dockerfile, so no
base digest to check; `packageManager` bun 1.4.2 is bun's latest;
`engines` (`node >=22 <25`) matches the org standard and the Node 24 LTS
the publish job uses; dependabot config (bun and actions ecosystems,
majors-only ignores on the eslint and TypeScript holds), and hook/CI
parity (hooks run eslint, typecheck and knip; CI adds the full test
suite and the build).

Deliberately not taken: eslint 10 and TypeScript 7 (org-wide holds), and
lefthook 2.1.14, published today and still inside the 24h release-age
soak. The `esbuild ^0.28.1` override stays: removing it resolves esbuild
back to 0.27.7.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

None.

## Test plan

Locally: `bun run lint`, `bun run typecheck`, `bun run knip`, `bun run
build`, `bun run test -- --coverage` (7 files, 167 passed, 9 skipped),
all exit 0. `osv-scanner` 2.6.0 over `bun.lock`: 492 packages, no
issues. Override drill run from a clean install with and without the
override.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Worked with Varun. The tag follows the merge.

Author: vvillait88

.github/workflows/security.yml

@@ -24,7 +24,7 @@ jobs:
 
       - name: Install osv-scanner
         run: |
-          curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.5.1/osv-scanner_linux_arm64 -o osv-scanner
+          curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_linux_arm64 -o osv-scanner
           chmod +x osv-scanner
 
       - name: Scan dependencies

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-score/sdk",
-  "version": "2.7.10",
+  "version": "2.7.11",
   "description": "TypeScript client for the AgentScore APIs",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",