fix(deps): patch browserslist security advisories

[joshuakrueger-dfx]

Summary

Pin the transitive Browserslist dependency to the minimal patched release 4.28.7 using npm overrides. The lockfile updates only the dependency versions required by that release.

Symptom (verbatim):
Unallowed high/critical vulnerabilities: browserslist [high]: GHSA-73WF-GQ98-2V4G, GHSA-C83G-RGW3-J3CX

Scale:
One package manifest entry and the corresponding lockfile resolution.

Smaller fix considered:
A direct dependency would unnecessarily expose a transitive build dependency. A broad npm audit fix was rejected because it can introduce unrelated upgrades; this override is the smallest scoped fix for the affected package.

Evidence

• On origin/develop, npm audit --json --audit-level=high and the repository CI audit policy fail on the two Browserslist advisories.
• With browserslist: 4.28.7 in overrides, the same CI policy passes with no non-allowlisted high/critical findings.
• The official advisories identify <=4.28.6 as affected and 4.28.7 as patched: GHSA-73wf-gq98-2v4g and GHSA-c83g-rgw3-j3cx

Validation

• npm ci --legacy-peer-deps --ignore-scripts
• npm run check
• npm test -- --coverage
• node scripts/check-coverage-floor.mjs
• node scripts/check-feature-matrix.mjs
• node scripts/check-visual-coverage.mjs and --self-test
• lockfile-lint
• npm run bundle:wdk
• npm run e2e:build:ios
• CI audit policy: old tree FAIL, fixed tree PASS

Known unrelated repository/toolchain issue: npm run bundle:bitbox still targets the nonexistent src/services/hardware-wallet/bitbox-wasm-html.ts path on develop; no BitBox source or runner path was changed here.

Measured lockfile churn: 23 additions and 20 deletions, all limited to browserslist and its required browser-data dependency resolutions.