ARSN-645: Replace deprecated and unmaintained dependencies

[francoisferrand]

Stacked on #2709 (ARSN-642 / Node 24 CI+engines). Doesn't touch anything from that ticket's scope (CI matrix, engines field, url.parse() migration, node-fcntl/httpagent floors).

What changed

Deprecated/unmaintained direct deps replaced:

• uuid ^10 → ^11
• Removed @types/ioredis (deprecated stub, ioredis ships its own types)
• Replaced archived backo with a shared lib/utils/Backoff.ts helper, exported from index.ts (Backbeat uses the same backoff logic and can consume this instead of vendoring its own copy)

Lockfile refresh:

• yarn upgrade --ignore-engines to pick up available transitive version bumps within existing semver ranges (no package.json range changes in that commit) — dropped combined yarn audit findings from moderate 113/high 245/critical 13 down to a handful

Targeted direct-dep CVE fixes surfaced by the refresh:

• ajv 6.12.3 → 6.15.0
• base-x 3.0.8 → 3.0.11
• @opentelemetry/* family bumped in lockstep (0.219.x/2.8.x → 0.220.x/2.9.x) to pull in a fixed propagator-jaeger
• nyc ^17.1.0 → ^18.0.0 (drops a vulnerable transitive uuid via istanbul-lib-processinfo)

prom-client peer dependency:

• Declared prom-client as a peerDependency (kept as a regular dependency too) since ZenkoMetrics needs to share the exact same registry singleton as the consuming app's own prom-client instance — relying on hoisting alone risks a silent duplicate registry if a transitive dep pins an incompatible range (e.g. node-rdkafka-prometheus in Backbeat).

Deliberately out of scope / left alone:

• @prometheus-io/client migration — investigated, reverted; prom-client stays. Backbeat's node-rdkafka-prometheus hardcodes require('prom-client') internally with no injection point, so a unilateral Arsenal swap breaks the shared-registry requirement. Follow-up needed (tracked separately).
• level/level-sublevel (archived) — still carries the last 3 remaining audit findings (2x bl, 1x semver), all transitive via level-sublevel > levelup. Large blast radius, needs its own migration investigation. Follow-up needed (tracked separately).

Validation

• yarn build, yarn lint clean
• Full unit suite: 4011/4021 passing (167/168 suites) — the one failure (tests/unit/network/http/server.spec.js, TLS cert alert) is pre-existing/environment-related, reproduces identically on the unmodified base branch too.
• Final combined (prod+dev) yarn audit: 2 moderate + 1 high + 0 critical, all from the untouched level/level-sublevel chain.

Issue: ARSN-645

[codecov]

Codecov Report

❌ Patch coverage is 54.33071% with 58 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.80%. Comparing base (3006f5a) to head (bab8157).

Files with missing lines	Patch %	Lines
lib/storage/data/external/GCP/GcpApis/mpuHelper.js	20.31%	51 Missing ⚠️
lib/network/kmip/index.ts	85.10%	7 Missing ⚠️

Additional details and impacted files

@@                   Coverage Diff                    @@
##           improvement/ARSN-642    #2710      +/-   ##
========================================================
+ Coverage                 74.75%   74.80%   +0.04%     
========================================================
  Files                       228      229       +1     
  Lines                     18673    18686      +13     
  Branches                   3873     3877       +4     
========================================================
+ Hits                      13959    13978      +19     
+ Misses                     4709     4703       -6     
  Partials                      5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.