fix: update vulnerable fast-uri dependency

[chasechou007]

Summary

• update Ajv's transitive fast-uri lockfile entry from 3.1.4 to patched 3.1.5
• record the dependency refresh in the alpha.8 changelog
• keep the public API and direct dependency ranges unchanged

Release context

The alpha.8 publication preflight detected GHSA-7p8r-x3mc-p8w7 as a high-severity npm audit finding. Publication is paused until this PR passes CI and review.

Validation

• volta run --node 20 npm test (178/178)
• npm audit --json (0 vulnerabilities)
• npm pack --dry-run --json --ignore-scripts --cache /private/tmp/opendomain-npm-cache (59 expected files)
• git diff --check

Domain Grounding Used

• Grounding Request: not_required
• Accepted IDs: none
• Candidate boundaries: none

[chasechou007]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: f2d40e4d14

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".