chore(deps): security bumps + in-range lockfile refresh

[apify-deps]

Summary

Dependency sweep — security bumps + in-range freshening (all within existing ranges):

• fast-uri → 3.1.7 (high) — fixes 4 alerts, all ranges collapsing to the same patched floor
• postcss-selector-parser → 7.1.6 (low)
• zod ^4.0.0 → ^4.5.4 (direct dep range bump in input_secrets/validations, expected side effect of the in-range refresh)

🚩 Flagged — needs review

• Existing overrides esbuild: ^0.28.1, tar: ^7.5.16, js-yaml@4: ^4.2.0 in pnpm-workspace.yaml — audited for staleness. None are no-ops: removing any of them lets an older (but not currently alerted, and no historical alert found either) version back in for a specific consumer (tsx``'s esbuild@0.27.7, an npm-tooling dep's tar@7.5.11vialerna, and lerna's own js-yaml@4.1.1`). Since there's no open or past Dependabot alert to confirm these floors are security-motivated, I couldn't confidently call dropping them safe — left all three in place pending a human check of why they were added.

🤖 Generated with Claude Code