feat: Add catalog workflow support, flow modifier, and security fixes

[fernandowiek]

Overview

This PR extends snsync with catalog workflow push support, a new flow modification tool, a catalog-to-script mapping validator, Update Set targeting via CLI flag, and dependency security patches.

---

What's Changed

✨ New Features

Catalog Workflow Push (--push)

• --push now detects catalog item folder structures (catalog_item/, variables/, client_scripts/) and pushes all related records in the correct order: catalog item → variables → client scripts.
• Supports bulk and targeted push for catalog items.

Update Set Targeting (--update-set)

• New --update-set <update_set_name> CLI flag to associate any push operation with a specific ServiceNow Update Set.
• Overrides the updateSetSysId value defined in sn-config.json at runtime, allowing flexible targeting without editing config files.
• The sys_id is forwarded as the X-UpdateSet request header on all REST API calls during a push, including flow pushes.
• Usage:

  node snsync --push projects/<your-project>/<table>/<record> --project projects/<your-project> --update-set <update_set_name>

Flow Modifier (_tool/flow-modifier.js)

• New module to pull, inspect, modify, and push ServiceNow Flow Designer flows via the API.
• Supports skip-approval, approval condition changes, and arbitrary action parameter modifications.
• New CLI commands:
  • --modify-flow — Pull and modify a flow (list, get, skip-approval, approval, modify operations)
  • --validate-flow — Validate a locally saved flow file before pushing
  • --push-flow — Push a modified flow back to ServiceNow

Catalog Mapping Validator (--validate-catalog-mapping)

• New command that validates the mapping between ServiceNow catalog UI variables and PowerShell script parameters.
• Detects missing parameters, extra unmapped variables, and type mismatches.
• Usage:

  node snsync --validate-catalog-mapping --project projects/<your-project>

---

🔒 Security Fixes

• Upgraded axios to ^1.13.6 (was ^1.7.4) — fixes CVE
• Added overrides.qs: ^6.15.0 — fixes CVE in transitive dependency
• npm audit clean: 0 vulnerabilities

---

🛠 Improvements

• Removed hardcoded project name from central config — tool now works generically across any project folder.
• Updated _tool/templates/sn-config.json with additional table mappings.
• Added VS Code launch.json for easier debugging.
• Documentation: updated README.md, AI_GUIDE.md, copilot-instructions.md, and added _tool/Docs/flow-modifier-usage.md.