Prevent module name path traversal

[Haowen Chen (haven2world)]

Summary

• reject module names that can be interpreted as POSIX or Windows paths before generating output files
• prevent untrusted @overrideModuleName values from escaping the configured output directory
• pin Mocha to 12.0.1 with the secure serialize-javascript dependency and Microsoft feed-compatible transitive dependency
• standardize local and CI builds on Node.js 22.15.1

Security impact

This fixes a CWE-22 path traversal where a crafted @overrideModuleName JSDoc value such as ../escaped could write generated Swift or Kotlin files outside the configured output directory.