Update `sinon` npm dependency

[desrosj]

The ​Sinon dependency is used to create spies and stubs for use within QUnit tests.

There are some breaking changes that are causing issues in the test suite that need to be addressed before upgrading.

Here is the output when running npm run grunt qunit:compiled using sinon@21.0.0:

Running "qunit:files" (qunit) task
Testing tests/qunit/compiled.html JQMIGRATE: Migrate is installed, version 3.4.1
Failed to load resource: net::ERR_FILE_NOT_FOUND
.............................................................................................Access to XMLHttpRequest at 'file:///wp-admin/admin-ajax.php' from origin 'null' has been blocked by CORS policy: Cross origin requests are only supported for protocol schemes: http, data, isolated-app, chrome-extension, chrome, https, chrome-untrusted.
Failed to load resource: net::ERR_FAILED
.....................................................................................FF.................................
>> dashboard > communityEvents.getTimeZone > modern browsers should return a time zone name
>> Message: undefined
>> Actual: UTC
>> Expected: America/Chicago
>>   at Object.<anonymous> (file:///home/runner/work/wordpress-develop/wordpress-develop/tests/qunit/wp-admin/js/dashboard.js:154:12)
>>     at callSandboxedFn (file:///home/runner/work/wordpress-develop/wordpress-develop/node_modules/sinon-test/dist/sinon-test.js:172:29)
>>     at Object.sinonAsyncSandboxedTest (file:///home/runner/work/wordpress-develop/wordpress-develop/node_modules/sinon-test/dist/sinon-test.js:192:30)
>> dashboard > communityEvents.getTimeZone > older browsers should fallback to a raw UTC offset
>> Message: negative offset
>> Actual: UTC
>> Expected: -300
>>   at Object.<anonymous> (file:///home/runner/work/wordpress-develop/wordpress-develop/tests/qunit/wp-admin/js/dashboard.js:166:12)
>>     at callSandboxedFn (file:///home/runner/work/wordpress-develop/wordpress-develop/node_modules/sinon-test/dist/sinon-test.js:172:29)
>>     at Object.sinonAsyncSandboxedTest (file:///home/runner/work/wordpress-develop/wordpress-develop/node_modules/sinon-test/dist/sinon-test.js:192:30)
>> Message: no offset
>> Actual: UTC
>> Expected: 0
>>   at Object.<anonymous> (file:///home/runner/work/wordpress-develop/wordpress-develop/tests/qunit/wp-admin/js/dashboard.js:170:12)
>>     at callSandboxedFn (file:///home/runner/work/wordpress-develop/wordpress-develop/node_modules/sinon-test/dist/sinon-test.js:172:29)
>>     at Object.sinonAsyncSandboxedTest (file:///home/runner/work/wordpress-develop/wordpress-develop/node_modules/sinon-test/dist/sinon-test.js:192:30)
>> Message: positive offset
>> Actual: UTC
>> Expected: 300
>>   at Object.<anonymous> (file:///home/runner/work/wordpress-develop/wordpress-develop/tests/qunit/wp-admin/js/dashboard.js:174:12)
>>     at callSandboxedFn (file:///home/runner/work/wordpress-develop/wordpress-develop/node_modules/sinon-test/dist/sinon-test.js:172:29)
>>     at Object.sinonAsyncSandboxedTest (file:///home/runner/work/wordpress-develop/wordpress-develop/node_modules/sinon-test/dist/sinon-test.js:192:30)
Testing tests/qunit/index.html JQMIGRATE: Migrate is installed with logging active, version 3.4.1
Failed to load resource: net::ERR_FILE_NOT_FOUND
.............................................................................................Access to XMLHttpRequest at 'file:///wp-admin/admin-ajax.php' from origin 'null' has been blocked by CORS policy: Cross origin requests are only supported for protocol schemes: http, data, isolated-app, chrome-extension, chrome, https, chrome-untrusted.
Failed to load resource: net::ERR_FAILED
.....................................................................................FF.................................
>> dashboard > communityEvents.getTimeZone > modern browsers should return a time zone name
>> Message: undefined
>> Actual: UTC
>> Expected: America/Chicago
>>   at Object.<anonymous> (file:///home/runner/work/wordpress-develop/wordpress-develop/tests/qunit/wp-admin/js/dashboard.js:154:12)
>>     at callSandboxedFn (file:///home/runner/work/wordpress-develop/wordpress-develop/node_modules/sinon-test/dist/sinon-test.js:172:29)
>>     at Object.sinonAsyncSandboxedTest (file:///home/runner/work/wordpress-develop/wordpress-develop/node_modules/sinon-test/dist/sinon-test.js:192:30)
>> dashboard > communityEvents.getTimeZone > older browsers should fallback to a raw UTC offset
>> Message: negative offset
>> Actual: UTC
>> Expected: -300
>>   at Object.<anonymous> (file:///home/runner/work/wordpress-develop/wordpress-develop/tests/qunit/wp-admin/js/dashboard.js:166:12)
>>     at callSandboxedFn (file:///home/runner/work/wordpress-develop/wordpress-develop/node_modules/sinon-test/dist/sinon-test.js:172:29)
>>     at Object.sinonAsyncSandboxedTest (file:///home/runner/work/wordpress-develop/wordpress-develop/node_modules/sinon-test/dist/sinon-test.js:192:30)
>> Message: no offset
>> Actual: UTC
>> Expected: 0
>>   at Object.<anonymous> (file:///home/runner/work/wordpress-develop/wordpress-develop/tests/qunit/wp-admin/js/dashboard.js:170:12)
>>     at callSandboxedFn (file:///home/runner/work/wordpress-develop/wordpress-develop/node_modules/sinon-test/dist/sinon-test.js:172:29)
>>     at Object.sinonAsyncSandboxedTest (file:///home/runner/work/wordpress-develop/wordpress-develop/node_modules/sinon-test/dist/sinon-test.js:192:30)
>> Message: positive offset
>> Actual: UTC
>> Expected: 300
>>   at Object.<anonymous> (file:///home/runner/work/wordpress-develop/wordpress-develop/tests/qunit/wp-admin/js/dashboard.js:174:12)
>>     at callSandboxedFn (file:///home/runner/work/wordpress-develop/wordpress-develop/node_modules/sinon-test/dist/sinon-test.js:172:29)
>>     at Object.sinonAsyncSandboxedTest (file:///home/runner/work/wordpress-develop/wordpress-develop/node_modules/sinon-test/dist/sinon-test.js:192:30)
Warning: 426 tests completed in 5685ms, with 4 failed, 0 skipped, and 0 todo. Use --force to continue.

This updates all devDependencies for 6.9 except:

• webpack: It's a bit too late to update this confidently.
• sinon: This has some breaking changes that need to be addressed (see Core-64228).

Trac ticket: Core-63171

Merged in https://core.trac.wordpress.org/changeset/61205.

This updates the sinon development dependency from 16.1.3 to the latest 22.0.0, as requested on the ticket, and regenerates package-lock.json. sinon-test and qunit are left unchanged, and the lockfile changes are confined to the sinon dependency subtree.

The bump surfaces the timezone test failures noted on the ticket. The communityEvents.getTimeZone tests in tests/qunit/wp-admin/js/dashboard.js stubbed Intl.DateTimeFormat.prototype.resolvedOptions, but getTimeZone() reads from a freshly constructed Intl.DateTimeFormat() instance. From sinon 17 onwards, the bundled @sinonjs/fake-timers mirrors Intl inside the sandbox, so a newly constructed instance no longer resolves to the prototype-level stub.

The tests are updated to replace the Intl.DateTimeFormat constructor via sinon.replace() (the ticket's suggested sinon.stub( Intl, 'DateTimeFormat' ) throws against the mirrored Intl), and to restore the sandbox at the end of each test to match the convention used elsewhere in the file. No production code is changed.

Testing: npm run grunt qunit:compiled reports 535/535 passing (0 failed) on both compiled.html and index.html. Before the change, the four documented getTimeZone assertions fail.

## Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 4.8
Used for: Analysing the sinon major-version breaking changes and the @sinonjs/fake-timers Intl mirroring behaviour, drafting the dependency update and the test adjustments, and running the QUnit suite. All changes were reviewed, tested, and are owned by me.

---
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See ​GitHub Pull Requests for Code Review in the Core Handbook for more details.