Incorrect version in package-lock.json triggers false positive for critical security vulnerability

In `~/.vscode-server/extensions/github.vscode-github-actions-0.26.3/script/workspace/package-lock.json`:

```
"vscode-github-actions": {
"version": "0.25.6",
```

So it looks like the declared version in the lock file (0.25.6) is older than the package version (0.26.3).

This in turn gets flagged in `grype`:

```
vscode-github-actions 0.25.6 npm GHSA-wvmr-x489-hcpj Critical
```

Which is quite the false alarm, given the severity of that particular issue:

https://github.com/advisories/GHSA-wvmr-x489-hcpj

~/.vscode-server/extensions/github.vscode-github-actions-0.26.3/script/workspace/package-lock.json を調べ、vscode-github-actions エントリをパッケージバージョン 0.26.3 と比較します。grype で結果を確認します。lock ファイルがバージョン 0.25.6 を報告せず、引用されている誤った脆弱性検出も発生させなくなれば完了です。

索引モデルが issue の本文から書いたものです。