build(deps): consolidate passing, advisory-clean Dependabot updates

[Copilot]

Combines the open Dependabot PRs that both pass CI and whose target versions have no reported security advisories (checked against the GitHub Advisory Database and npm audit), so they can land as a single change instead of 15 separate merges.

GitHub Actions

• github/codeql-action v4 → v4.37.4 (build(deps): bump github/codeql-action from 4 to 4.37.4 #485)
• actions/setup-dotnet v5.3.0 → v6.0.0 (build(deps): bump actions/setup-dotnet from 5.3.0 to 6.0.0 #466)

Python dev requirements (microsoft_agents_m365copilot_core/requirements-dev.txt)

• h2 4.3.0 → 4.4.1 (build(deps-dev): bump h2 from 4.3.0 to 4.4.1 in /python/packages/microsoft_agents_m365copilot_core #502), cryptography 48.0.1 → 50.0.0 (build(deps-dev): bump cryptography from 48.0.1 to 50.0.0 in /python/packages/microsoft_agents_m365copilot_core #497), aiohttp 3.13.4 → 3.14.3 (build(deps-dev): bump aiohttp from 3.13.4 to 3.14.3 in /python/packages/microsoft_agents_m365copilot_core #489), setuptools 78.1.1 → 83.0.0 (build(deps-dev): bump setuptools from 78.1.1 to 83.0.0 in /python/packages/microsoft_agents_m365copilot_core #480)

TypeScript lockfile (typescript/package-lock.json)

• undici 6.27.0 → 6.28.0 (build(deps-dev): bump undici from 6.27.0 to 6.28.0 in /typescript #499), ip-address 10.2.0 → 10.4.0 (build(deps-dev): bump ip-address from 10.2.0 to 10.4.0 in /typescript #487), postcss 8.5.16 → 8.5.25 (build(deps-dev): bump postcss from 8.5.16 to 8.5.25 in /typescript #484), fast-xml-parser 5.9.3 → 5.10.1 (build(deps-dev): bump fast-xml-parser from 5.9.3 to 5.10.1 in /typescript #481), axios 1.16.0 → 1.19.0 (build(deps-dev): bump axios from 1.16.0 to 1.19.0 in /typescript #471)

Excluded, with rationale

• build(deps-dev): bump the development-dependencies group across 1 directory with 20 updates #486 (development-dependencies group, 20 updates) — typescript (22.x) and check-build-matrix failed.
• build(deps): bump actions/setup-node from 6 to 7 #468 (setup-node 7), build(deps): bump actions/setup-python from 6 to 7 #465 (setup-python 7) — only the CLA check ran; no build validation to confirm against.
• build(deps-dev): bump nx from 22.5.4 to 22.7.8 in /typescript #483 (nx 22.7.8) — the target version is still covered by a high-severity advisory via transitive brace-expansion. Dropping it also avoids the exact axios@1.18.1 pin nx 22.7.8 introduces, which would block the advisory-clean axios 1.19.0 bump.

Net effect on the TypeScript tree: npm audit findings go from 15 to 9; the remainder (brace-expansion, diff, js-yaml, lerna, nx, picomatch, sinon, tar, yaml) are pre-existing with no advisory-clean upgrade available here.