fix: remove bogus ncc dependency that introduces ws vulnerabilities

PR #230 accidentally added `ncc` (node-chrome-canvas) to dependencies.
This is unrelated to `@vercel/ncc` (already in devDependencies) and
pulls in ws@2.3.1 which has multiple known vulnerabilities:

- GHSA-3648-7jhf-9vrq (DoS via many HTTP headers — high)
- CVE-2024-37890 (Denial of Service in ws — high)

Remove the bogus dependency and regenerate the lock file.

Closes #273

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: GJaubert

package-lock.json

@@ -21,8 +21,7 @@
     "@actions/core": "^1.10.0",
     "@actions/github": "^6.0.0",
     "@aws-sdk/client-ec2": "^3.1028.0",
-    "lodash": "^4.18.1",
-    "ncc": "^0.3.6"
+    "lodash": "^4.18.1"
   },
   "devDependencies": {
     "@vercel/ncc": "^0.38.1",