onnxruntime-node: bump adm-zip to >=0.6.0 to resolve GHSA-xcpc-8h2w-3j85

### Problem

Current `onnxruntime-node` releases, including `1.27.0` and the latest `1.29.0-dev` builds, declare `adm-zip: ^0.5.16`. All `adm-zip` versions below `0.6.0` are affected by [GHSA-xcpc-8h2w-3j85](https://github.com/advisories/GHSA-xcpc-8h2w-3j85) / CVE-2026-39244 (crafted ZIP metadata can trigger an approximately 4 GB allocation and process OOM).

Because `^0.5.16` cannot resolve to `0.6.0`, downstream libraries cannot remediate this by widening their own direct `adm-zip` range: npm installs a nested vulnerable `adm-zip@0.5.x` under `onnxruntime-node`. Library-level `overrides` also do not propagate to consumers.

### Reproduction

```sh
npm init -y
npm install onnxruntime-node@1.27.0 adm-zip@^0.6.0
npm ls adm-zip
npm audit
```

The tree contains both top-level `adm-zip@0.6.0` and nested `onnxruntime-node/node_modules/adm-zip@0.5.x`; npm reports the high-severity advisory through `onnxruntime-node`.

### Requested change

Please update the `onnxruntime-node` dependency to `adm-zip >=0.6.0` (ideally `^0.6.0`) and publish a patched stable release. `adm-zip` 0.6.0 is the first patched version. Its documented extraction behavior changes should be checked against the package-install extraction path.

This currently forces downstreams that need Intel macOS support to choose between an older ONNX Runtime release without the vulnerable dependency or carrying a native-package fork/consumer override.

Start by locating the onnxruntime-node package manifest and its package-install extraction path. Reproduce the dependency tree with the provided npm commands, then verify that adm-zip resolves to at least 0.6.0 and that the documented extraction behavior still works before the patched stable release is published.

Written by the indexing model from the issue text.