deps: Bump tar-fs to 3.0.9 (#15719)

tar-fs 3.0.9 fixes CVE-2025-48387
(https://security.snyk.io/vuln/SNYK-JS-TARFS-10293725

Contributed by STMicroelectronics

Signed-off-by: Torbjörn SVENSSON <[email protected]>

Author: Torbjorn-Svensson

package-lock.json

@@ -14,7 +14,7 @@
     "multer": "2.0.0",
     "rimraf": "^5.0.0",
     "stat-mode": "^1.0.0",
-    "tar-fs": "^3.0.8",
+    "tar-fs": "^3.0.9",
     "trash": "^7.2.0",
     "tslib": "^2.6.2",
     "vscode-languageserver-textdocument": "^1.0.1"