fix(deps): patch critical/high CVEs in next, sharp, and transitive deps

[acamarata]

Summary

• Fixes both critical advisories that were failing the Dependency Audit workflow on main: GHSA-p293-qw3h-jr36 and GHSA-2xp9-vwfh-vxw4 (Next.js RCE, next <16.3.3). Note: these two plus the sharp/libheif high (GHSA-rgj7-g3m4-5g8c) were independently fixed by Dependabot's own auto-merged PR chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates #101 while this PR was in flight; this branch has been rebased on top of that, so the diff here is now only the remaining transitive advisories Dependabot could not auto-resolve.
• Extends pnpm.overrides at the workspace root for 8 transitive deps the native Dependabot Updates job reported as security_update_not_possible: @babel/core, @humanfs/node, @opentelemetry/core, decode-uri-component, fast-xml-parser, linkify-it, protobufjs, uuid, plus js-yaml (flagged by pnpm audit, not gating but a safe win). Every override is scoped to stay within the dependency's existing major version to avoid unintended breaking bumps.
• Adds a path-scoped override webpack-bundle-analyzer>ws — the pre-existing blanket ws@>=8.0.0 override in this file was silently not being honored for that specific transitive edge, leaving ws@8.20.0 resolved (vulnerable) even though the override text was already present. Confirmed via the regenerated lockfile that only ws@8.21.3 remains anywhere in the tree now.

Not fixed — needs an owner decision

stream-json (GHSA-528h-pc64-c93x, moderate, path minio>stream-json, O(depth²) DoS on crafted nested JSON). I initially added an override to >=3.5.0 (the patched floor) but this broke the production build: minio@8.0.7 (the latest published minio) hard-depends on stream-json@^1.8.0 and its code does require('stream-json/jsonl/Parser.js'), a file path that was removed in the 3.x rewrite. CI caught this (Build, Build (production), Docker multi-platform check all failed with Module not found: Can't resolve 'stream-json/jsonl/Parser.js'). There is no minio release compatible with stream-json 3.x, so this can't be patched without either minio updating or replacing minio. Left as-is; this is the one remaining moderate finding (not gating — the Dependency Audit gate only fails on critical).

Verification

• pnpm audit --json on the regenerated lockfile: critical/high/moderate/low now 0/0/1/0 (was 2/6/9/1 before this branch existed).
• Confirmed via lockfile grep that every previously-vulnerable resolved version (@babel/core@7.29.0, @opentelemetry/core@2.6.1/2.7.0, ws@8.20.0, js-yaml@3.15.1/4.3.1) is gone; only patched versions remain, each within its original major.
• Checked whether admin has the same self-hosted-runner defect that broke web's Dependabot PR Gate (gh CLI missing on vars.CI_RUNNER, web#232). It does not — dependabot-review.yml already runs on ubuntu-latest; the Dependabot Updates failures here were purely dependency-resolution (security_update_not_possible), not infra.
• One inert note left as-is: next's optional styled-jsx peer slot resolves @babel/core@8.0.5 (pnpm's peer auto-install doesn't appear to honor the override for that specific optional-peer edge). Not a vulnerability (8.0.5 is past the patched floor) and inert — this repo has no babel config, so Next's default SWC compiler is used and styled-jsx's babel path is never invoked.
• CI on this PR: Security Audit, Lint, TypeScript, Unit Tests, Jest Coverage, License Gate, gitleaks all green. Build / Build (production) / Docker multi-platform check were red on the stream-json override and are expected to go green now that it's reverted — re-verifying.