fix: modernize website dependency security

[ranadeepsingh]

Related Issues/PRs

• Stacked on fix: restore Azure pipeline Docker authentication #2573.
• ADO Bug 5469322.
• Original Component Governance evidence: build 228104679.

What changes are proposed in this pull request?

Issue

The legacy website used Yarn 1, Node 18, Docusaurus 2.4.1, and React 16. Its
yarn.lock produced 112 Component Governance alerts, including two Critical
findings. The lock also depended on an obsolete dependency graph that could not
be remediated safely with isolated transitive upgrades.

Fix

• Move the website to Node 20, npm, Docusaurus 3.10.2, and React 18.3.1.
• Replace yarn.lock with an npm v3 lock containing 1,298 SHA-512 integrity
  records and no internal registry or mutable resolved URLs.
• Apply targeted overrides for affected transitive packages and run npm ci,
  tests, and the production build in website CI.
• Add a tested MDX 3 compatibility preprocessor that preserves fenced code
  blocks, plus the required Prism renderer and historical-link updates.
• Update version-bump automation and contributor documentation from Yarn to
  local npm commands.
• Pin Codecov CLI v11.3.1, verify its official SHA-256 before execution, and
  keep the upload token environment-only.
• Narrow unit-test Key Vault access from the full vault to only
  codecov-token, load it immediately before the PR-only upload, and retain
  coverage uploads after failed tests with succeededOrFailed().

Security outcome

• All prior Critical and High affected versions are removed.
• 111 of the 112 original Component Governance alerts are eliminated. The ADO
  Component Governance task now reports one Low string_decoder@1.3.0 alert
  inherited through the current webpack-dev-server -> spdy development-only
  path.
• The final npm audit has no Critical, Moderate, or Low findings. Its only
  vulnerable package is brace-expansion@1.1.16
  (GHSA-mh99-v99m-4gvg),
  which npm reports as fixAvailable: false. It is inherited from the latest
  Docusaurus/serve-handler static-server path and receives only trusted
  configured glob patterns; this PR avoids introducing an unmaintained fork or
  install-time mutation to hide the advisory.

How is this patch tested?

• I have written tests and confirmed the proposed change works.
• npm test under Node 20: 2 tests passed.
• npm run build under Node 20: Docusaurus production build passed.
• npm ls --all: dependency tree valid with fast-uri@3.1.4.
• python -m pytest -q scripts/test_bump_version.py: 177 tests passed.
• black --check --extend-exclude 'docs/' scripts/bump-version.py scripts/test_bump_version.py
• sbt scalastyle test:scalastyle
• Changed YAML and JSON syntax validation.
• Lock consistency, integrity algorithm, registry URL, old-alert comparison,
  and npm audit checks.
• ADO Component Governance detection succeeded and reported one Low alert,
  down from the original 112 alerts including two Critical findings.
• GitHub Website Deploy build passed from a fresh public-registry install.
• Full ADO build 228133377
  passed every website, style, build, publish, Python, R, CPU/GPU Databricks,
  Fabric, and all but one unit job. The sole failure was one agent receiving an
  azureedge.net certificate for msdata.visualstudio.com while obtaining its
  Key Vault OIDC token; the same Key Vault task passed in 61 sibling jobs.
• Targeted ADO unit rerun 228141069
  passed, confirming the failure was transient infrastructure rather than a
  code regression.
• Latest hardening commit 9a5e7d6f9f passed GitHub Website Deploy, CodeQL,
  dependency review, YAML parsing, Black (178 files), Scala style, and
  whitespace validation.
• Clean targeted ADO build 228246262
  passed BuildDocker, conda setup, and all 40 unit-test matrix jobs on the
  latest commit. The PR-only Codecov secret task remains intentionally
  excluded from manual builds because Build.Reason is system-controlled.

Does this PR change any dependencies?

• No. You can skip this section.
• Yes. The website moves from Yarn to npm and upgrades to Node 20,
  Docusaurus 3.10.2, React 18.3.1, current math/Prism integrations, and patched
  transitive dependency versions recorded in website/package-lock.json.

Does this PR add a new feature? If so, have you added samples on website?

• No. This is dependency, compatibility, and supply-chain maintenance.
• Yes. Make sure you have added samples following the template steps.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

Hey @ranadeepsingh 👋!
Thank you so much for contributing to our repository 🙌.
Someone from SynapseML Team will be reviewing this pull request soon.

We use semantic commit messages to streamline the release process.
Before your pull request can be merged, you should make sure your first commit and PR title start with a semantic prefix.
This helps us to create release messages and credit you for your hard work!

Examples of commit messages with semantic prefixes:

• fix: Fix LightGBM crashes with empty partitions
• feat: Make HTTP on Spark back-offs configurable
• docs: Update Spark Serving usage
• build: Add codecov support
• perf: improve LightGBM memory usage
• refactor: make python code generation rely on classes
• style: Remove nulls from CNTKModel
• test: Add test coverage for CNTKModel

To test your commit locally, please follow our guild on building from source.
Check out the developer guide for additional guidance on testing your change.

[ranadeepsingh]

/azp run

[azure-pipelines]

Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.

[ranadeepsingh]

ADO validation note: /azp run was filtered because this is a stacked PR whose base branch is outside the pipeline PR trigger list. The exact PR commit was therefore queued manually. Full build 228133377 passed every website, style, publish, Python, R, Databricks, Fabric, and all but one unit job; one agent hit a transient Key Vault OIDC TLS certificate mismatch while the same task passed in 61 sibling jobs. Targeted unit rerun 228141069 passed all unit jobs, and the PR status is green.