The major OTel SDK bump (sdk-node 0.54 → 0.219) broke the otlp-node
Lambda's runtime instrumentation: index.js still uses the OTel 1.x API
(new Resource({...}), provider.addSpanProcessor) which silently fails on
the 2.x SDK, so no traces are emitted and the OTLP integration suite
returns 0 traces for the node runtime.

Revert otlp-node deps to the 0.54.2 / 1.28.0 / 1.x line and rely on a
top-level protobufjs override (^7.6.4) to pull in the patched protobufjs
without changing the public OTel API surface. This still resolves the
high-severity protobufjs alerts (DoS via unbounded recursion, code
generation gadgets, prototype injection, etc.) and #191/#192 via the
transitive @grpc/[email protected].

The lone critical (GHSA-xq3m-2v4x-88gg, fixed in protobufjs 8.0.1) is
not closed here because the major requires updating index.js to the OTel
2.x API — tracking as follow-up.

Lock regenerated with npm 10.8.2 (node 20) to match CI's resolver.

## Overview

Consolidates the 6 open Dependabot/ADMS vulnerability PRs into a single
PR.

| Source PR | Manifest | Notes |
|---|---|---|
| #1258 | `integration-tests/lambda/otlp-java/pom.xml` |
`io.opentelemetry:opentelemetry-api` 1.58.0 → 1.63.0 |
| #1259 | `local_tests/golang/go.{mod,sum}` | `aws-sdk-go`,
`golang.org/x/net`, `golang.org/x/sys` minor bumps |
| #1260 | `integration-tests/lambda/otlp-node/package*.json` |
Superseded by #1263 (lock already has `@grpc/[email protected]`,
`@protobufjs/utf8` override carried over) |
| #1261 | `integration-tests/package*.json` | `uuid` 9 → 14 (ported
manually onto #1262 to avoid lock conflict) |
| #1262 | `integration-tests/package*.json` | `axios` 1.15 → 1.18, plus
overrides for `@opentelemetry/core`, `fast-xml-parser`,
`fast-xml-builder`, `fast-uri`, `brace-expansion` |
| #1263 | `integration-tests/lambda/otlp-node/package*.json` | Major
OTel SDK bump (`@opentelemetry/sdk-node` 0.54 → 0.219, `protobufjs`
7.5.4 → 7.6.4) |

Closes the following Dependabot alerts: #191, #192 (`@grpc/grpc-js`);
#183–#190 + older axios alerts; protobufjs alerts via the major OTel SDK
bump; uuid #180; OpenTelemetry Java #176.

## Testing

GitHub Actions checks (Build All, Test Suite, Clippy, Audit, CodeQL)
passed on each individual source PR. `dd-gitlab/*` checks failed
identically on all 6 — appears to be an unrelated infra/permissions
issue with the bot-authored branches. Re-running CI on this branch
(created from a maintainer account) should clear them.

The vendored deps live entirely under `integration-tests/` and
`local_tests/`, so they have no impact on the shipped extension binary.

---------

Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com>