chore: update cdxgen

[KLongmuirHD]

• address npm audit issues with npm audit fix scoped down the PR to just one dependency
• update cdxgen to latest
• cdxgen upstream change, changed the type signature of the postProcess function from returning any to Object. Change is made to cast back to any. CI tests will catch regressions.

[marco-ippolito]

I don't think this is a good idea, dependency update should be handled by dependabot (and similar).
Running audit fix and pushing the updated lock file creates a hidden discrepancy:
Audit fix can upgrade/downgrade a package in the package lock, but when someone runs npm i gets a different version. It also means by downgrading you might get bugs that were later fixed.
It also might break some packages the dependency tree that expected a certain feature/fix from a dependency.
The fact that some dependencies have an advisory is not inherently bad or mean our application is vulnerable.
Audit fix causes more hard than good because it blindly tries to migrate a package to the closest version without an advisory which is dangerous.

[KLongmuirHD]

@marco-ippolito thanks for the feedback. I scoped down the changes to just an explicit bump of cdxgen, and that's it. I'll let dependabot pick up the rest.