deps: bump mysql2 to 3.24.3 (GHSA-3f6p-5ww8-9rcr, GHSA-rgwj-5xj2-c3m3)

[katsugtgz]

Updates mysql2 to address GHSA-3f6p-5ww8-9rcr and GHSA-rgwj-5xj2-c3m3.

Evidence:

• package-lock.json pinned mysql2@3.12.0, core/package.json required ^3.11.3
• osv-scanner reported GHSA-3f6p-5ww8-9rcr and GHSA-rgwj-5xj2-c3m3 against mysql2@3.12.0 before the update
• updated version: 3.24.3

Validation:

• osv-scanner no longer reports either advisory for mysql2 after the update
• CI=true npm run test --workspaces passes (193 tests in core, 53 passed plus 1 todo in panel), same result as on master before the change
• .env with TXDEV_FXSERVER_PATH and TXDEV_VITE_URL was created first, matching .github/workflows/run-tests.yml

Note: osv-scanner still reports separate advisories for other packages in the lockfile (minimatch, tar, nanoid, ajv, undici, vite and others). This patch only clears the two mysql2 advisories.

Scope: dependency and lockfile update only.

[tabarra]

Hey there, thanks for the PR!
I'm not against updating the lib (definitely this and others are in my TODO list), but I don't see how either reported vulns are relevant for txAdmin.

GHSA-3f6p-5ww8-9rcr Summary
A rogue MySQL server (or MITM) can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql_clear_password. The driver complies without verifying that TLS is active.

A rogue server isn't a concern, and if some setup gets to a "MITM is possible" scenario, the leaked db password is the least of their problems.

GHSA-rgwj-5xj2-c3m3 Attack Scenario
Application connects with mysql2/mysql2/promise using compress: true (a documented option for reducing bandwidth, commonly used for cloud/WAN DB connections).

We do not have compression enabled in neither of the call sites:

txAdmin/core/deployer/recipeEngine.js

Lines 369 to 377 in 8a9a414

	//Connect to the database
	const mysqlOptions = {
	host: deployerCtx.dbHost,
	port: deployerCtx.dbPort,
	user: deployerCtx.dbUsername,
	password: deployerCtx.dbPassword,
	multipleStatements: true,
	};
	deployerCtx.dbConnection = await mysql.createConnection(mysqlOptions);

txAdmin/core/routes/deployer/actions.js

Lines 119 to 126 in 8a9a414

	const mysqlOptions = {
	host: userVars.dbHost,
	port: userVars.dbPort,
	user: userVars.dbUsername,
	password: userVars.dbPassword,
	connectTimeout: 5000,
	};
	await mysql.createConnection(mysqlOptions);

I'll defer this to when we do the next big batch of deps version bumps... which might actually happen on the next txAdmin master-branch update (not just enhanced). And because of that I'm closing this PR, but if I'm missing something (eg details or attack scenario) please do let me know and I'll have a second look :)