feat: add security sink detection patterns for JavaScript/TypeScript

- Introduced `sink-detect.js` with various security sink detection patterns categorized by type (e.g., command injection, SQL injection, file operations).
- Implemented functions to build a lookup map for fast sink detection and to match sink calls against known patterns.
- Added `package-lock.json` for dependency management.

src/__Libraries/StellaOps.DeltaVerdict/Signing/DeltaSigningService.cs

@@ -114,11 +114,21 @@ public sealed class DeltaSigningService : IDeltaSigningService
 
     private static string ComputeSignature(byte[] pae, SigningOptions options)
     {
-        return options.Algorithm switch
+        return ComputeSignatureCore(pae, options.Algorithm, options.SecretBase64);
+    }
+
+    private static string ComputeSignature(byte[] pae, VerificationOptions options)
+    {
+        return ComputeSignatureCore(pae, options.Algorithm, options.SecretBase64);
+    }
+
+    private static string ComputeSignatureCore(byte[] pae, SigningAlgorithm algorithm, string? secretBase64)
+    {
+        return algorithm switch
         {
-            SigningAlgorithm.HmacSha256 => ComputeHmac(pae, options.SecretBase64),
+            SigningAlgorithm.HmacSha256 => ComputeHmac(pae, secretBase64),
             SigningAlgorithm.Sha256 => Convert.ToBase64String(SHA256.HashData(pae)),
-            _ => throw new InvalidOperationException($"Unsupported signing algorithm: {options.Algorithm}")
+            _ => throw new InvalidOperationException($"Unsupported signing algorithm: {algorithm}")
         };
     }