🐛 Start the AppFixture server on the loopback address

[flovouin]

📝 Description of the PR

Tests relying on the AppFixture could transiently fail with responses coming from an unrelated server, e.g. a 407 Proxy Authentication Required, a 404, or even a 200 with an unexpected body. This happened because the application's HTTP server was only started by supertest, which listens on the IPv6 wildcard address without specifying a host. Because SO_REUSEADDR is set on every TCP bind, this succeeds even when another process already listens on 127.0.0.1 with the same port. supertest then sends its request to 127.0.0.1, and the kernel routes it to the most specific matching socket, i.e. the other process. Any loopback-only listener within the ephemeral port range is a hazard, and because supertest binds a new random port for every request, a full test run has a fair chance of hitting one.

The AppFixture now explicitly starts the server on the loopback address during initialization. supertest skips its own listen when the server already has an address, such that requests can only reach the application. As the server is bound only once, it now stays open until the fixture is deleted, which makes calling AppFixture.delete (as documented) all the more important.

This PR also upgrades the dependencies, which is unrelated to the fix.

📋 Check list

• 🧪 Unit tests have been written.
• 📝 Documentation has been updated.