security: fix all npm vulnerabilities

- Remove unused xlsx dependency (had unfixable vulnerabilities)
- Add npm overrides to force secure versions:
  - jszip ^3.10.1 (fixes path traversal)
  - nth-check ^2.1.1 (fixes ReDoS)
  - lodash.pick -> lodash ^4.17.21 (fixes prototype pollution)

Result: 0 vulnerabilities (was 11)

Amit Haridas

package.json

@@ -83,8 +83,12 @@
     "pdfkit": "^0.17.2",
     "pizzip": "^3.2.0",
     "simple-git": "^3.32.3",
-    "tslib": "^2.8.1",
-    "xlsx": "^0.18.5"
+    "tslib": "^2.8.1"
+  },
+  "overrides": {
+    "jszip": "^3.10.1",
+    "nth-check": "^2.1.1",
+    "lodash.pick": "npm:lodash@^4.17.21"
   },
   "build": {
     "appId": "com.concreteinfo.markdownconverter",