[Security upgrade] bump socket.io-client fork to ws@^8.21.0 (#35060)

* bump socket.io-client to overleaf fork 0.9.17-overleaf-6

Fixes GHSA-96hv-2xvq-fx4p (ws memory exhaustion DoS) by bumping the
overleaf/socket.io-client fork to a version that declares ws@^8.21.0
instead of ws@^1.1.5. The existing ws@npm:^8 resolution pins it to
8.21.0, removing ws@1.1.5 from yarn.lock entirely.

Depends on overleaf/socket.io-client#6.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* use 0.9.17-overleaf-6 tag for socket.io-client

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* use the socket.io-client-0.9.17-overleaf-6 release

* provide ws module for real-time acceptance tests

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Brian Gough <briangough@users.noreply.github.com>
Co-authored-by: Brian Gough <brian.gough@overleaf.com>
GitOrigin-RevId: 2d9a42f90bcf95a3a8f053df4c0092c4fbc26422

services/real-time/package.json

@@ -34,7 +34,7 @@
     "lodash": "^4.18.1",
     "proxy-addr": "^2.0.7",
     "socket.io": "github:overleaf/socket.io#0.9.19-overleaf-12",
-    "socket.io-client": "github:overleaf/socket.io-client#0.9.17-overleaf-5",
+    "socket.io-client": "https://github.com/overleaf/socket.io-client/archive/refs/tags/0.9.17-overleaf-6.tar.gz",
     "zod-validation-error": "^4.0.1"
   },
   "devDependencies": {
@@ -49,6 +49,7 @@
     "timekeeper": "0.0.4",
     "typescript": "^5.0.4",
     "uid-safe": "^2.1.5",
-    "vitest": "4.1.5"
+    "vitest": "4.1.5",
+    "ws": "^8.21.0"
   }
 }