fix(deps): replace vulnerable xlsx release

[alexandroit]

Why

Base UI uses xlsx in the lazy workbook helper and directly in DataGrid for worksheet range decoding. The npm xlsx@0.18.5 release is affected by GHSA-4r6h-8v6p-xvw6 (prototype pollution) and GHSA-5pgg-2g8v-p4x9 (ReDoS).

This changes only the dependency target to "xlsx": "npm:@stackline/xlsx@^1.0.6". Existing static and dynamic imports remain unchanged. @stackline/xlsx is an independent, maintained SheetJS-compatible fork with regression tests for both advisories. Its Node 20+ requirement is satisfied by this repository's node >=24 engine.

Disclosure: I maintain the Stackline fork. A neutral alternative is SheetJS CE 0.20.3 from the official tarball.

Validation

• pnpm install --frozen-lockfile --ignore-scripts: passed
• pnpm check:circular-deps: no source circular dependency found
• pnpm build:rollup-clean && pnpm build:rollup: passed
• XLSX write/read round-trip: passed
• malicious __proto__ / constructor worksheet headers: no Object.prototype pollution
• pnpm why xlsx: resolves xlsx <- @stackline/xlsx@1.0.6

Rollup still reports the existing cycles inside third-party dependencies; the baseline build reports the same class of warnings.

Only package.json and pnpm-lock.yaml are changed.