Monitor xlsx (SheetJS) dependency situation

First, the [xlsx](https://www.npmjs.com/package/xlsx) package we currently depend on seems to be, maybe, an abandoned version? Their current docs refer to it as a "[legacy endpoint](https://docs.sheetjs.com/docs/getting-started/installation/nodejs/#legacy-endpoints)", but they also refer to it being out of date as a "registry bug". They have a second NPM repo, which they refer to as a placeholder, named [sheetjs](https://www.npmjs.com/package/sheetjs), but it's also out of date.

Recently, the maintainers moved from GitHub to a [self hosted repo](https://git.sheetjs.com/sheetjs/sheetjs). It's unclear if the npm repos are out of date because of that (the "registry bug" they vaguely refer to in their docs?) or by a conscious choice to leave NPM. Their current installation guide wants us to [install tarballs right from their CDN](https://docs.sheetjs.com/docs/getting-started/installation/nodejs/#installation), which is a bit awkward to manage. They've not directly responded to [questions](https://git.sheetjs.com/sheetjs/sheetjs/issues/3112) about why they're gone this direction.

There are a lot of up-to-date "unofficial" mirrors on NPM, but that's trading convenience for trust. If they don't get the official NPM packages updating, we'll have to either look for an alternative dependency for our sheet parsing needs or just deal with the inconvenience of installing via their CDN...