fix: override undici to ^6.24.0 to resolve GHSA-vrm6-8vpv-qv8q

Add npm overrides to force undici to ^6.24.0, fixing the WebSocket
permessage-deflate decompression bomb vulnerability (CVE-2026-1526).
This updates undici from 5.29.0 to 6.24.1 across all transitive
dependencies (@actions/core and @actions/github).

Agent-Logs-Url: https://github.com/github/webpack-bundlesize-compare-action/sessions/83dc3a69-3a72-415b-837e-dafd4cb7c840

Co-authored-by: arelia <2359538+arelia@users.noreply.github.com>

Author: Copilot

package-lock.json

@@ -29,6 +29,9 @@
     "@actions/github": "^6.0.1",
     "@discoveryjs/json-ext": "^0.6.3"
   },
+  "overrides": {
+    "undici": "^6.24.0"
+  },
   "devDependencies": {
     "@stylistic/eslint-plugin": "^5.6.1",
     "@types/node": "^25.0.0",