add 2025-09-8 malware attack packages upper bounds and ignore in .nsprc

[philvarner]

Related Issue(s):

• n/a

Proposed Changes:

1. this malware attack caused some packages to be flagged by npm audit, but only because the github vulnerabilities had an overly loose constraint of >=0 on the versions for them, even though only one latest version was compromised. This PR pins a max version on those packages to prevent them from being used, and adds the vulnerability numbers to the audit ignore file.

PR Checklist:

• I have added my changes to the CHANGELOG or a CHANGELOG entry is not required.