fix: pin axios to v1.14.0 to mitigate supply chain attack

Axios v1.14.1 and v0.30.4 were compromised in a supply chain attack
on March 30-31, 2026. Pin to exact v1.14.0 (last safe version) to
prevent resolution to malicious versions.

CRITICAL: Previous range ^1.7 included compromised v1.14.1.

Ref: https://socket.dev/blog/axios-npm-package-compromised

Author: apetre-ionos

package-lock.json

@@ -67,7 +67,7 @@
     "@oclif/plugin-autocomplete": "^3",
     "@oclif/plugin-help": "^6",
     "@aws-sdk/client-s3": "^3",
-    "axios": "^1.7",
+    "axios": "1.14.0",
     "chalk": "^4",
     "diff": "^8.0.3",
     "enquirer": "^2.3.6",
@@ -82,4 +82,4 @@
       "minimatch": "10.2.1"
     }
   }
-}
+}