feat: implement `deno audit --fix` (#32909)
## Summary
- Add `--fix` flag to `deno audit` that automatically upgrades
vulnerable direct dependencies to patched versions
- Skip major version upgrades (reported as unfixable) to avoid breaking
changes
- Skip unsupported version spec styles (e.g. `>=1 <2`, `1.x`, tags,
aliases) -- reported as unfixable instead of silently rewriting them to
a caret range
- Report transitive dependencies that can't be auto-fixed
- Reuse existing `DepManager` infrastructure from `deno outdated
--update` for dependency modification
- Updates `package.json`/`deno.json` and regenerates lockfile after
fixes
## Example output
```
╭ @denotest/with-vuln1 is susceptible to prototype pollution
│ ...
Found 2 vulnerabilities
Severity: 0 low, 0 moderate, 1 high, 1 critical
Fixed 1 vulnerability:
@denotest/with-vuln1 1.0.0 -> 1.1.0
1 vulnerability could not be fixed automatically:
@denotest/with-vuln2 (major upgrade to 2.0.0)
```
