LTS-4657: override ip-address to ^10.4.0 — fixes GHSA-mwp4-54f8-5fhr (leading-zero octet SSRF)

ip-address 10.2.0 arrives transitively via socks (^10.1.1) under
browserstack-node-sdk -> @kubernetes/client-node -> socks-proxy-agent, and via
proxy-agent/pac-proxy-agent under @wdio/utils. Address4 decoded a leading-zero
octet as decimal while resolvers decode it as octal, so isPrivate()/isInSubnet()
could misclassify an internal target as public.

10.4.0 clears all three open advisories on the installed 10.2.0:
  GHSA-mwp4-54f8-5fhr (high,   <= 10.3.0)          patched 10.3.1
  GHSA-4xrf-jv44-h6hh (medium, 10.1.1 - 10.2.1)    patched 10.2.2
  GHSA-22jq-vg5j-6vgg (medium, 10.1.1 - 10.2.0)    patched 10.2.1

Verified: npm ci from this lock installs ip-address@10.4.0 (overridden),
npm audit no longer reports ip-address, and the advisory PoC now behaves as
patched — Address4.isValid('012.0.0.1') === false and the constructor throws
AddressError, while '10.0.0.1' still parses.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: MihirR-BS

package-lock.json

@@ -37,6 +37,7 @@
     "tmp": "0.2.7",
     "esbuild": "^0.28.1",
     "serialize-javascript": "^7.0.3",
+    "ip-address": "^10.4.0",
     "glob@10": {
       "minimatch": "^9.0.7"
     },