test: FORMS-1683 update cross-spawn for security fix

[WalterMoar]

Description

The GitHub Dependabot process has created an alert for the cross-spawn dependency. To satisfy the requirements outlined in the Security Threat and Risk Assessment's (STRA) Statement of Acceptable Risks (SoAR), this vulnerability must be handled by updating the package version (or mitigated in some other way, if updating the package is not possible).
https://github.com/bcgov/common-hosted-form-service/security/dependabot/217

Acceptance Criteria

• cross-spawn no longer appears in the list of dependabot security vulnerabilities
• the tests continue to function correctly

Type of Change

test (add missing tests or correct existing tests)

Checklist

• I have read the CONTRIBUTING doc
• I have checked that unit tests pass locally with my changes
• I have run the npm script lint on the frontend and backend
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)
• I have approval from the product owner for the contribution in this pull request

Further comments

The cypress package includes execa, which includes cross-spawn. Although we're a few minor versions behind the latest Cypress, the latest does not include the fix yet. As a temporary fix just update cross-spawn in the package-lock, but open another task to track Cypress and do the proper fix when it arrives.