stream-json ^1.7.3 has no non-vulnerable resolution (CVE-2026-71429 / GHSA-528h-pc64-c93x)

### [REQUIRED] Environment info
**firebase-tools:**
15.29.0 (latest; also reproduces on 15.22.1, 15.0.0, 14.0.0, 13.0.0)

**Platform:**
macOS 26.5.2 (arm64), node v26.5.0 / npm 11.17.0
also reproduces on ubuntu-latest with node 22.22.3 in CI

### [REQUIRED] Test case
```bash
mkdir fb-repro && cd fb-repro
npm init -y
npm i firebase-tools@15.29.0
npm audit --omit=dev
```

### [REQUIRED] Steps to reproduce
1. Install `firebase-tools` (any version — see below) into a clean project.
2. Run `npm audit --omit=dev`.

### [REQUIRED] Expected behavior
A clean install of the latest `firebase-tools` has a remediation path for known advisories in its dependency tree i.e. `npm audit` either passes, or `npm audit fix` resolves it without a breaking downgrade.

### [REQUIRED] Actual behavior
`npm audit` reports a moderate advisory with **no non-breaking remediation**:

```
stream-json <=3.4.0
Severity: moderate
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input —
small crafted JSON blocks the event loop for seconds→minutes (DoS)
- https://github.com/advisories/GHSA-528h-pc64-c93x
fix available via `npm audit fix --force`
Will install firebase-tools@10.1.1, which is a breaking change
node_modules/stream-json
```

**The root cause:**
`firebase-tools` declares `stream-json: ^1.7.3` and resolves to `1.9.1`.
CVE-2026-71429 / GHSA-528h-pc64-c93x affects `stream-json <= 3.4.0`, so every version resolvable under `^1.7.3` is affected.

There are no patched releases inside the declared range. The only fixed versions are 3.5.0 and 3.6.0, which break firebase-tools.

`^1.7.3` is the declared range on every version I sampled: 13.0.0, 14.0.0, 15.0.0, 15.10.0, 15.20.0, 15.22.1, 15.26.0, 15.28.0 and 15.29.0 (latest).

This blocks CI for anyone whose pipeline gates on `npm audit`, with no available remediation.

The obvious fix of npm audit fix will silently break the CLI. Overriding to `stream-json@^3.6.0` will install cleanly and `firebase --version` will still print correctly, but 3.x moved its subpath exports, and four of the five entry points `firebase-tools` requires fail to resolve:

```
node -e "require('stream-json')" # OK
node -e "require('stream-json/filters/Filter')" # MODULE_NOT_FOUND
node -e "require('stream-json/filters/Pick')" # MODULE_NOT_FOUND
node -e "require('stream-json/streamers/StreamArray')" # MODULE_NOT_FOUND
node -e "require('stream-json/streamers/StreamObject')" # MODULE_NOT_FOUND
```

**Call sites:**
`lib/commands/auth-import.js`, `lib/database/import.js`, `lib/frameworks/next/index.js`. The failure only surfaces when one of those paths runs, so an override ships looking healthy and breaks later. It took down a deploy as it hit exactly this basically.

So the bump to `^3.5.0` needs the import paths updated alongside it.

No one seemed to have reported this with regards to CVE-2026-71429 / GHSA-528h-pc64-c93x so I figured it's a non-dupe.