fix(deps): replace vulnerable xlsx release

[alexandroit]

Why

Angular T9n dynamically imports xlsx in its translation import and export services. The npm xlsx@0.18.5 release is affected by GHSA-4r6h-8v6p-xvw6 (prototype pollution) and GHSA-5pgg-2g8v-p4x9 (ReDoS).

This changes only the dev dependency target to "xlsx": "npm:@stackline/xlsx@^1.0.6". Existing import('xlsx') calls and TypeScript usage remain unchanged. @stackline/xlsx is an independent, maintained SheetJS-compatible fork with regression tests for both advisories. Its Node 20+ requirement is below this repository's Node 24.15 development contract.

Disclosure: I maintain the Stackline fork. A neutral alternative is SheetJS CE 0.20.3 from the official tarball.

Validation

• npm ci --ignore-scripts: passed
• npm run lint: passed
• npm test: 170 passed
• npm run build: passed
• XLSX write/read round-trip and malicious-header pollution check: passed
• npm ls xlsx --all: resolves xlsx@npm:@stackline/xlsx@1.0.6

The XLSX code remains a lazy chunk. Its estimated transfer size changes from 119.24 KB in the baseline build to 136.57 KB; the initial application chunk remains 517.78 KB. This is disclosed as the measurable cost of moving from the old npm build to the hardened current fork.

Only package.json and package-lock.json are changed.