fix: resolve 17 high/critical Dependabot security alerts

- Update semantic-kernel[azure] from 1.28.0 to 1.40.0 (CVE: InMemoryVectorStore RCE, Arbitrary File Write)
- Add npm overrides to fix transitive dependency vulnerabilities:
  - serialize-javascript >=7.0.3 (RCE via RegExp.flags)
  - bfj >=9.1.3 (removes vulnerable jsonpath dependency)
  - underscore >=1.13.8 (DoS via unlimited recursion)
  - svgo >=3.3.3 (DoS via Billion Laughs)
  - d3-color and nth-check pinned to top-level safe versions
- Remove duplicate d3-color and lodash-es entries in package.json
- Regenerate package-lock.json with all overrides applied

Author: Shubhangi-Microsoft

docs/workshop/docs/workshop/requirements.txt

@@ -2,7 +2,7 @@
 azure-identity==1.21.0
 azure-ai-evaluation==1.5.0
 # Additional utilities
-semantic-kernel[azure]==1.28.0
+semantic-kernel[azure]==1.40.0
 azure-ai-projects==1.0.0b8
 openai==1.74.0
 pyodbc==5.2.0