fix: address dependency vulnerabilities and report privacy

[TheRealAgentK]

Description

Purpose: Resolve current dependency advisories and prevent error-report contents from appearing in transport diagnostics.

Approach: Update compatible dependencies, remove payloads and transport error text from logging, and add privacy regression and sample integration coverage.

Type of change

• Bug fix
• Documentation update

Updates

• Patch all six vulnerable development dependencies, including ip-address 10.7.3, and update the Express example to Morgan 1.12.1 and proxy-addr 2.0.8.
• Remove payloads from success, timeout, transport-failure, skipped-report, and oversized-batch diagnostics. Preserve transport errors returned to callers, except oversized-report errors no longer include payload excerpts.
• Document exact request-filter boundaries and onBeforeSend redaction for custom data and breadcrumbs.
• Replace example smoke checks with real localhost reporting tests for Express /send, /error, and /skip, plus the domains intentional crash flow.

Test plan

• Builds and full SDK tests passed locally on Node 20, 22, and 24 (312 assertions).
• New sample integration tests passed on Node 20, 22, and 24 (15 assertions, plus child-process HTTP response checks).
• CommonJS compatibility, ESLint, TypeScript ESLint, formatting, and git diff checks passed.
• Full and production audits are clean for the SDK and both examples; registry signatures verified.
• No live Raygun service was contacted by sample tests.

Author checks

• Builds successfully
• Locally tested
• Regression and integration tests provided
• Lint and formatting checks passed
• Documentation updated

Delivery notes

No version bump or npm publication is included. Release this SDK before raising the Lambda wrapper dependency baseline. Dependabot alerts should close after merging and rescanning the default branch.