Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.9.3 to 6.0.3.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v6.0.3)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 6.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

**Problem**

TS6 strict mode flags lying return types in ConfigParser: string()
could return undefined but declared `string`, callers masked it with
`as string`/`as boolean`/`as number` casts that hid real type
unsafety across all config files.

**Proposal**

Add proper overloads so single-arg calls (`string(path)`,
`boolean(path)`, `number(path)`) return the truthful required type
and throw on missing/invalid values. Two-arg calls with
`undefinedIfEmpty: true` return `string | undefined` for optional
config values. Remove lying casts from all core-fca-low config files.

**Problem**

TS6 6.0 tightens `Object.entries()` on `unknown`, removes the `glob`
global, disallows `symbol` as object index key, and changes overload
resolution for `ejs.renderFile` — 9 type errors blocked the build.
Additionally, lodash `chain()` silently handled `undefined` inputs
but native `.flatMap()` throws, and the null→undefined change
in `oidc-client.controller` broke its test expectation.

**Proposal**

- Cast `Object.entries` arg to `Record<string, unknown>` and add index
  signature casts for `panvaFormatted`
- Import `glob` from `node:fs/promises` and mock as async iterable
- Replace `Symbol("sessionCookieName")` with a string literal
- Annotate `markdownGenerateResult` as `string[]`
- Use `as any` on ejs mock callback and generator mock where type
  boundaries don't risk correctness
- Guard `getIdpDomains` with `idps ?? []` to preserve null-safety
- Update oidc-client controller spec to expect `undefined` over `null`