Updated socks package to a version that doesn't use the IP package

[shrshindeMSFT]

For more information about how to contribute to this repo, visit this page.

Description

This repo has a CG violation for the ip project. The ip project has a published security vulnerability:
indutny/node-ip#136
GHSA-78xj-cgh5-2h22

Unfortunately, there's no fixed version of the ip project. Moreover, there are questions in the "Issues" section of that project asking whether there's even a maintainer for it.

We indirectly use ip because we use lerna, which has a whole chain of dependencies which eventually leads to ip
The package in that chain which depends on ip is socks. The socks package HAS been updated to stop depending on "ip" given the uncertainty of getting a fix in ip.

This change forces us to use the latest version of socks that removes the ip dependency. Eventually, over probably a while, the whole lerna dependency change will update to use this newer version of socks, but who knows how long that will take. In the meantime, this override ensures that with our current set of dependencies we no longer consume the vulnerable version of ip.

I also added a section to our package.json file that provides room to explain what each override is for, as a way of hopefully helping our future selves to know when we might be able to remove any of them. As the explanation the file says, it's a hacky way of putting comments in the file since comments are not allowed in JSON.

If this Pull Request should close/resolve any issues when merged, use the special syntax for that here.

Main changes in the PR:

Override socks package in package.json file.

Unit Tests added:

Unit tests are required for all changes. If no unit tests were added as part of this change, please explain why they aren't necessary.

N/A

End-to-end tests added:

N/A

Additional Requirements

Change file added:

Ensure the change file meets the formatting requirements.

N/A

[AE-MS]

A few questions