fix: Force dependencies on async to v 3.2.3 - main branch

[BruceHaley]

Fixes #4188

Description

This fixes the high severity Component Governance alerts for async. Example alert.
The alerts recommend "Upgrade async...to 3.2.2 to fix the vulnerability." V 3.2.3 is now the latest, so using that one.

The parent dependency, adal-node 0.2.3, has no updates available. And migrating to its replacement, ADAL for Node.js, requires code rewrites. So I have tried here forcing the async dependency to a safe version. The adal-node dependency tree:

botframework-connector@4.1.6 C:\src\botbuilder-js\libraries\botframework-connector
`-- adal-node@0.2.3
  `-- async@2.6.3

Specific Changes

Add "async": "3.2.3" to the "resolutions" section of package.json file. Yarn picks that up and forces all dependencies to use that version.

Testing

This fix was incorporated in packages with version number v4.16.0-dev.20220415.369fcc4 and pushed to MyGet for testing.
The packages were tested in the 8 Samples E2E test pipelines for JS and for TS, and they all passed.

[coveralls]

Pull Request Test Coverage Report for Build 2174146596

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage decreased (-0.003%) to 84.482%

---

Totals
Change from base Build 2172847391:	-0.003%
Covered Lines:	19909
Relevant Lines:	22316

---

💛 - Coveralls