fix: upgrade js-yaml to patched version (CVE-2026-84375)

[anupamme]

Summary

Resolve js-yaml to the patched 4.3.2 release to fix CVE-2026-84375.

Reworked per review feedback: the previous version of this PR pinned js-yaml
via a package.json overrides block. That's been removed. Instead, the
lockfile was regenerated from scratch (rm -rf node_modules package-lock.json && npm install), which resolves js-yaml to 4.3.2 on its own — every
consumer in the tree (@bedrock/config-yaml, postcss-loader →
cosmiconfig, swagger-jsdoc → swagger-parser →
@apidevtools/json-schema-ref-parser, @bedrock/test → mocha) already
declares a ^4.x range that permits 4.3.2; the prior lockfile just had it
pinned stale at 4.3.1. Confirmed with npm ls js-yaml that every resolved
copy is now 4.3.2, with no overrides needed.

Vulnerability

Field	Value
ID	CVE-2026-84375
Severity	HIGH
Scanner	trivy
Rule	CVE-2026-84375
File	package-lock.json (dependency: js-yaml)
Assessment	Present in dependency tree, not confirmed reachable

Description: js-yaml: Denial of Service vulnerability in YAML parsing
(CPU exhaustion via crafted YAML merge sources; affects js-yaml >=4.0.0 <4.3.2 and >=3.0.0 <3.15.2, patched in 4.3.2/3.15.2).

Changes

• package.json: no override, no range changes — existing ranges already
  permit the patched version.
• package-lock.json: regenerated so js-yaml resolves to 4.3.2 throughout
  the dependency tree.

Behavior Preservation

This change touches only dependency manifests (package.json,
package-lock.json); no source file in the repository is modified.

---

js-yaml versions in the dependency tree are affected by CVE-2026-84375. This
PR updates dependency resolution to the upstream patched releases.
Reachability of attacker-controlled YAML input was not established.

---

Originally an automated security fix by OrbisAI Security, reworked manually per maintainer review.

[davidlehn]

• Using pinned version overrides is not ideal here. That would lock them forever until someone remembers to go remove those lines.
• The added yaml dep in the lock file seems odd.
• The better solution here, which we'll get to soon, is to do regular dependency updates that also update the lock file. That would more naturally pull in this patch update (assuming it's not pinned in dependencies) along with other fixes and updates.
• I haven't deeply looked into this, but I suspect this particular js-yaml would only effect unlikely local bad configurations.

[anupamme]

Review comments addressed. Pls review.