fix(deps): bump js-yaml to 4.2.0 (CVE-2026-53550)

[chagong]

Fixes Dependabot alert #94.

Vulnerability

• Advisory: GHSA-h67p-54hq-rp68 / CVE-2026-53550
• Package: js-yaml (npm, dev dependency, transitive via cosmiconfig)
• Severity: Medium (CVSS 5.3)
• Summary: Quadratic-complexity DoS in merge-key (<<) handling via repeated aliases. A crafted YAML document can cause CPU exhaustion when parsed.
• Vulnerable range: <= 4.1.1
• Patched version: 4.2.0

Change

Bumped js-yaml 4.1.1 → 4.2.0 in package-lock.json (npm update js-yaml). 4.2.0 satisfies the existing ^4.1.0 constraint, so only the lockfile changed.

Note: tslint still pulls in js-yaml@3.14.2 (constraint ^3.13.1), which cannot move to the 4.x line. Dependabot raised only alert #94 for the 4.x instance, which this PR resolves.