Fix CVEs: add npm overrides for picomatch, yaml, brace-expansion, lodash

Add overrides to resolve known vulnerabilities:
- picomatch@2 -> 2.3.2 (ReDoS via extglob quantifiers)
- picomatch@4 -> 4.0.4 (ReDoS via extglob quantifiers)
- yaml@1 -> 1.10.3 (stack overflow via deeply nested collections)
- brace-expansion@2 -> 2.0.3 (zero-step sequence hang)
- lodash -> 4.18.1 (prototype pollution and code injection)

Remaining: brace-expansion 1.x (1.1.12) has no fixed version available.

Author: mraible

ui/extensions/hello/package-lock.json

@@ -68,9 +68,13 @@
   },
   "overrides": {
     "js-yaml": "^3.14.2",
-    "lodash": "4.17.23",
+    "lodash": "4.18.1",
     "svgo": "2.8.1",
     "minimatch@3": "3.1.4",
-    "minimatch@9": "9.0.9"
+    "minimatch@9": "9.0.9",
+    "picomatch@2": "2.3.2",
+    "picomatch@4": "4.0.4",
+    "yaml@1": "1.10.3",
+    "brace-expansion@2": "2.0.3"
   }
 }

ui/extensions/hello/package.json

@@ -3857,6 +3857,9 @@ class Navigation {
             },
         });
     }
+    /**
+     * @deprecated Use navigateTo directly
+     */
     async onClick(event, defaultTarget = '_self', defaultType = 'falcon') {
         if (!(event instanceof Event)) {
             throw Error('"event" property should be subclass of Event');