node: bump to 22.23.0

node: bump to 22.23.0

This is a security release.
Notable Changes

    (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
    (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
    (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
    (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
    (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
    (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
    (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
    (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
    (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
    (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
    (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

Signed-off-by: Hirokazu MORIKAWA <redacted>