chore(deps): resolve all open Dependabot CVEs via npm overrides

[nmccready]

Summary

• Resolves all 8 open Dependabot alerts on master — all transitive devDependencies inside package-lock.json.
• Pinned via overrides in package.json so the fixes survive future npm install runs.

Overrides added / updated

Package	Was	Now	Alert(s)
fast-xml-parser	5.3.6 (pinned)	5.7.0	#20, #19, #5, #2
brace-expansion	1.1.12 / 5.0.4 / 5.0.5	5.0.9	#23, #22 (+ GHSA-mh99, GHSA-rgw5 caught by npm audit)
flatted	3.3.3	3.4.2	#4
picomatch	4.0.3	4.0.4	#8
minimatch@<3.1.4	3.1.3 (via dotgitignore)	3.1.4	GHSA-23c5 ReDoS (surfaced by audit, scoped override so eslint's 10.x tree is untouched)

The prior fast-xml-parser: "5.3.6" override was actively pinning the vulnerable version — that's what kept dependabot's auto-bumps from taking.

Test plan

• npm install succeeds; lockfile regenerated
• npm audit → found 0 vulnerabilities
• npm run lint:js (eslint) clean
• npm test (go test) passes
• CI tests workflow green
• All 8 Dependabot alerts auto-close after merge