Support package.json overrides for vulnerability remediation

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Feature description

We’d like the tool to use overrides in package.json for dependency vulnerability fixes, instead
of only updating package-lock.json. Right now, it only changes the lockfile. While that may fix the immediate issue, it does not clearly document the intended dependency constraint in source control. Using overrides would make the remediation explicit and persistent, especially when lockfiles are regenerated or dependencies are reinstalled.

https://[docs.npmjs.com/cli/v8/configuring-npm/package-json#overrides](https://docs.npmjs.com/cli/v8/configuring-npm/package-json#overrides)

Start by tracing the existing vulnerability-remediation path that currently updates package-lock.json, then review the package.json overrides documentation linked in the issue. Done means npm dependency fixes can be represented as explicit package.json overrides rather than only lockfile changes, with the existing remediation behavior preserved.

Written by the indexing model from the issue text.