fix: patch newly reported dependency vulnerabilities

[maxatwork]

Summary

• Patch the two open high-severity Dependabot alerts for js-yaml.
• Pin the transitive nanoid dependency to the first fixed 3.x release found by npm audit.
• Raise the repository's lockfile security-test thresholds so these versions cannot regress.

Security findings

• Dependabot Added ability to have one-char sub-objects #59: development js-yaml, GHSA-5p4m-2wfm-xmqj — https://github.com/maxatwork/form2js/security/dependabot/59
• Dependabot [enhancement] Add missing bower.json. #60: runtime js-yaml, GHSA-5p4m-2wfm-xmqj — https://github.com/maxatwork/form2js/security/dependabot/60
• npm audit: transitive development nanoid vulnerability GHSA-2v37-7h3g-55p8 — GHSA-2v37-7h3g-55p8

Changes

• js-yaml 4.x: 4.3.0 → 4.3.1
• js-yaml 3.x under read-yaml-file: 3.15.0 → 3.15.1
• nanoid: 3.3.16 → 3.3.18

Validation

• npm_config_cache=/private/tmp/form2js-npm-cache npm ci
• npx vitest run test/integration/dependency-security.test.ts
• npm audit --audit-level=high
• npm run build
• npm run lint
• npm run typecheck
• npm run test:packages
• npm run test:integration
• npm run test:docs
• git diff --check

The PR should be merged only after required GitHub checks and reviews are green.

---

Summary by cubic

Patches high-severity vulnerabilities by upgrading js-yaml and pinning nanoid, and tightens dependency-security tests to prevent regressions.

• Upgrades js-yaml 4.x to 4.3.1 and the nested 3.x under read-yaml-file to 3.15.1.
• Adds a top-level nanoid at 3.3.18 to pin the first fixed 3.x release found by npm audit.
• Updates the dependency security test to fail if js-yaml < 4.3.1 (or < 3.15.1 for v3) or nanoid < 3.3.18.
• No runtime behavior changes; only dependency versions and stricter tests.

^{Written for commit 15e030d. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}