security: bump cookie and attempt glib bump

[chznbaum]

fixes https://github.com/chznbaum/lodestar/security/dependabot/1

Attempts to also address the glib vulnerability but this depends on specific tauri dependencies migrating off an unmaintained package. Creating an issue to track.

[greptile-apps]

Greptile Summary

This PR updates dependency locks to address vulnerable packages. The main changes are:

• Forces npm cookie resolution to ^0.7.0.
• Updates package-lock.json to resolve cookie as 0.7.2.
• Bumps several Tauri-related Rust lockfile entries, including tauri and tray-icon.

Confidence Score: 4/5

The dependency update looks mergeable after checking the forced cookie range against SvelteKit cookie handling.

• The Rust lockfile updates match the existing broad Tauri constraints.
• The npm override intentionally fixes the vulnerable cookie version.
• The override crosses the only inspected consumer's declared cookie range, so cookie parsing behavior should be checked.

package.json

Important Files Changed

Filename	Overview
package.json	Adds an npm override that forces all cookie consumers to resolve to ^0.7.0.
package-lock.json	Refreshes the resolved cookie package to 0.7.2 and updates npm lock metadata.
src-tauri/Cargo.lock	Updates Tauri-related lockfile entries within the existing Rust manifest constraints.

_{Reviews (1): Last reviewed commit: "Merge branch 'main' into security/bump-g..." | Re-trigger Greptile}

[greptile-apps]

Cookie Override Crosses Consumer Range

@sveltejs/kit is the only inspected consumer of cookie and declares cookie as ^0.6.0, but this override forces every install to use 0.7.x. If SvelteKit depends on a 0.6.x parsing or serialization edge case, server-side cookie handling can change at runtime while the app still type-checks and installs cleanly.