es5-ext dependency is quarantined by Nexus Firewall, blocking hermetic builds

## Problem

The `es5-ext` npm package (both 0.10.63 and 0.10.64) has been quarantined by Nexus Firewall under advisory sonatype-2022-2248. Its `_postinstall.js` script makes network calls to geolocate the host and executes undisclosed code (classified as protestware). Both versions are flagged; there is no clean upstream version.

This blocks any hermetic/hardened supply chain build that prefetches npm dependencies through an artifact registry proxy, resulting in:

```
FetchError: 403, message='--- Requested item is quarantined ---'
url='https://artifact-registry-proxy.../npm-proxy/es5-ext/-/es5-ext-0.10.63.tgz'
```

## Dependency chain

`es5-ext` enters code-server through the VS Code submodule (`lib/vscode/`):

- `gulp-sourcemaps` → `debug-fabulous` → `memoizee` → `es5-ext` (build tooling, devDependency)
- Also via `d`, `es6-iterator`, `es6-symbol`, `es6-weak-map`, `esniff`, `event-emitter`, `timers-ext`

## Upstream status

- [microsoft/vscode#310541](https://github.com/microsoft/vscode/issues/310541) — closed, maintainer said PRs welcome
- [microsoft/vscode#160012](https://github.com/microsoft/vscode/issues/160012) — older duplicate, also closed
- [medikoo/es5-ext#186](https://github.com/medikoo/es5-ext/issues/186) — upstream protestware discussion (4 years old)

## Suggested fix

Add an npm `overrides` entry in `lib/vscode/package.json` to alias `es5-ext` to [`@unes/es5-ext`](https://www.npmjs.com/package/@unes/es5-ext), a community fork that strips the postinstall script and rebases daily against upstream:

```json
"overrides": {
"es5-ext": "npm:@unes/es5-ext@0.10.64-1"
}
```

We have implemented this fix in our downstream build at [opendatahub-io/notebooks#3556](https://github.com/opendatahub-io/notebooks/pull/3556).