Update to comply with secure registry

[millerds]

Change Description:
Update .npmrc to use a compliant registry feed
Also include some package updates.

1. Do these changes impact any npm scripts commands (in package.json)? (e.g., running 'npm run start')
   No.

2. Do these changes impact VS Code debugging options (launch.json)?
   No.

3. Do these changes impact template output? (e.g., add/remove file, update file location, update file contents)
   No.

4. Do these changes impact documentation? (e.g., a tutorial on https://docs.microsoft.com/en-us/office/dev/add-ins/overview/office-add-ins)
   No.

If you answered yes to any of these please do the following:
> Include 'Rick-Kirkham' in the review
> Make sure the README file is correct

Validation/testing performed:
Ran automated tests

[millerds]

@copilot resolve the merge conflicts in this pull request

[Copilot]

Pull request overview

Updates the project to comply with a secure/compliant npm registry feed, including documentation updates and dependency refreshes, plus a small E2E test helper refactor away from the deprecated request package.

Changes:

• Switch .npmrc to the OfficeDev Azure Artifacts registry and enable always-auth.
• Update several dev dependencies (Office add-in tooling, webpack-dev-server, copy-webpack-plugin) and remove request.
• Refactor E2E debugger attachment helper to use fetch instead of request, and document registry authentication steps in README.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 3 comments.

File	Description
test/end-to-end/src/debugger-websocket.ts	Replaces request with fetch and makes URL discovery awaitable in the reconnect flow.
README.md	Adds npm registry authentication instructions for the new feed.
package.json	Updates devDependency versions and removes request.
.npmrc	Points npm to the compliant OfficeDev registry and enables always-auth.

Comments suppressed due to low confidence (1)

test/end-to-end/src/debugger-websocket.ts:33

• If wsUrl is still undefined after the retry loop (e.g., the debugger never becomes available), the function continues and constructs new WebSocket(wsUrl), which will throw. It should bail out when retries are exhausted.

  while (!wsUrl && reconnectTry < limitOfReconnectTries) {
    console.log(`Attaching debugger to '${jsonUrl}'...`);
    await findUrl(jsonUrl);
    reconnectTry++;
    await sleep(1000);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the merge conflict in package-lock.json. The conflict was due to a hono version bump on master — I kept the PR branch version (4.12.31) resolved from the OfficeDev registry (office.pkgs.visualstudio.com), which is consistent with the registry compliance goal of this PR.