Template Sync: Bump picomatch

### 🔄 Template Sync Required

Changes from the upstream [vscode-python-tools-extension-template](https://github.com/microsoft/vscode-python-tools-extension-template) have not yet been incorporated into this repository.

#### Source PR
- [microsoft/vscode-python-tools-extension-template#287 — Bump picomatch](https://github.com/microsoft/vscode-python-tools-extension-template/pull/287)

#### Summary
The template repository bumped `picomatch` from `2.3.1` to `2.3.2` (main dependency) and from `4.0.3` to `4.0.4` (used by `tinyglobby`). This is a security/maintenance update to `package-lock.json`. This repository still references the older versions.

#### Files with missing changes

- **`package-lock.json`**: Still pins `picomatch` at `2.3.1` and `4.0.3`. The template now pins `2.3.2` and `4.0.4` with updated resolved URLs and integrity hashes.

#### Suggested fix

Run `npm install` or `npm update picomatch` to regenerate `package-lock.json` with the updated versions, or manually apply the following diff:

````diff
--- a/package-lock.json
+++ b/package-lock.json
@@ -5597,9 +5597,9 @@
"node_modules/picomatch": {
- "version": "2.3.1",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
- "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+ "version": "2.3.2",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+ "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
"dev": true,
"engines": {
"node": ">=8.6"
@@ -6898,9 +6898,9 @@
"node_modules/tinyglobby/node_modules/picomatch": {
- "version": "4.0.3",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
- "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+ "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
"dev": true,
"engines": {
"node": ">=12"
````

The same version bump should also be applied to the legacy `"dependencies"` section entries at the bottom of `package-lock.json` (lines ~11602 and ~12484).

#### Files skipped

None — `package-lock.json` is a shared infrastructure file.

---
🤖 This issue was auto-generated by the [`extension-template-sync`](.github/workflows/extension-template-sync.md) workflow.

> Generated by [Extension Template Sync](https://github.com/microsoft/vscode-black-formatter/actions/runs/23639064872)

Start by running npm update picomatch or npm install in the repository. Check package-lock.json for picomatch 2.3.2 and 4.0.4 in both the node_modules and legacy dependencies sections, including updated resolved URLs and integrity hashes. The work is done when the lockfile matches the requested versions and the generated diff contains no unrelated changes.

Written by the indexing model from the issue text.