chore: add govsignals CVE-remediation pnpm overrides

Pre-applies the pnpm-overrides.json from govsignals hardened Dockerfiles
into package.json so the lockfile is consistent and `pnpm fetch
--frozen-lockfile` succeeds during Docker builds.

Replaces upstream scoped overrides (form-data@^2, axios@1.9.0, etc.)
with blanket CVE-driven versions. Adds overrides for ws, tar, semver,
@babel/runtime, cookie, undici, zod, Remix packages, and others.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: amarbakir-govsignals

package.json

@@ -74,7 +74,52 @@
     "node-fetch": "2.6.x"
   },
   "overrides": {
-    "cross-spawn": "7.0.5"
+    "cross-spawn": "7.0.5",
+    "ws": "8.17.1",
+    "tar-fs": "3.1.1",
+    "tar": "7.5.9",
+    "semver": "5.7.2",
+    "@babel/runtime": "7.27.0",
+    "tmp": "0.2.4",
+    "@isaacs/brace-expansion": "5.0.1",
+    "cookie": "0.7.0",
+    "glob": "10.5.0",
+    "minimatch": "10.2.3",
+    "fast-xml-parser": "5.3.8",
+    "ajv": "8.18.0",
+    "markdown-it": "14.1.1",
+    "axios": "1.13.5",
+    "jsonpath": "1.2.1",
+    "lodash": "4.17.23",
+    "lodash-es": "4.17.23",
+    "form-data": "4.0.4",
+    "js-yaml": "4.1.1",
+    "qs": "6.14.2",
+    "@upstash/ratelimit": "1.1.3",
+    "@grpc/grpc-js": "^1.8.22",
+    "crypto-js": "^4.2.0",
+    "graphql": "^16.8.1",
+    "next": "14.2.35",
+    "on-headers": "^1.1.0",
+    "path-to-regexp": "^0.1.12",
+    "prismjs": "^1.30.0",
+    "send": "^0.19.0",
+    "serialize-javascript": "7.0.4",
+    "undici": "6.23.0",
+    "word-wrap": "^1.2.4",
+    "postcss": "^8.4.31",
+    "nodemailer": "7.0.11",
+    "jsondiffpatch": "0.7.2",
+    "ai": "5.0.52",
+    "zod": "3.25.76",
+    "redlock": "5.0.0-beta.2",
+    "@remix-run/node": "2.17.4",
+    "@remix-run/react": "2.17.4",
+    "@remix-run/express": "2.17.4",
+    "@remix-run/serve": "2.17.4",
+    "@remix-run/server-runtime": "2.17.4",
+    "@remix-run/dev": "2.17.4",
+    "@remix-run/router": "1.23.2"
   },
   "pnpm": {
     "patchedDependencies": {
@@ -94,16 +139,54 @@
       "express@^4>body-parser": "1.20.3",
       "@remix-run/dev@2.1.0>tar-fs": "2.1.3",
       "testcontainers@10.28.0>tar-fs": "3.0.9",
-      "form-data@^2": "2.5.4",
-      "form-data@^3": "3.0.4",
-      "form-data@^4": "4.0.4",
-      "axios@1.9.0": ">=1.12.0",
-      "js-yaml@>=3.0.0 <3.14.2": "3.14.2",
-      "js-yaml@>=4.0.0 <4.1.1": "4.1.1",
+      "form-data": "4.0.4",
+      "axios": "1.13.5",
+      "js-yaml": "4.1.1",
       "jws@<3.2.3": "3.2.3",
-      "qs@>=6.0.0 <6.14.1": "6.14.1",
+      "qs": "6.14.2",
       "systeminformation@>=5.0.0 <5.27.14": "5.27.14",
-      "lodash@>=4.0.0 <4.17.23": "4.17.23"
+      "lodash": "4.17.23",
+      "ws": "8.17.1",
+      "tar-fs": "3.1.1",
+      "tar": "7.5.9",
+      "semver": "5.7.2",
+      "cross-spawn": "7.0.5",
+      "@babel/runtime": "7.27.0",
+      "tmp": "0.2.4",
+      "@isaacs/brace-expansion": "5.0.1",
+      "cookie": "0.7.0",
+      "glob": "10.5.0",
+      "minimatch": "10.2.3",
+      "fast-xml-parser": "5.3.8",
+      "ajv": "8.18.0",
+      "markdown-it": "14.1.1",
+      "jsonpath": "1.2.1",
+      "lodash-es": "4.17.23",
+      "@upstash/ratelimit": "1.1.3",
+      "@grpc/grpc-js": "^1.8.22",
+      "crypto-js": "^4.2.0",
+      "graphql": "^16.8.1",
+      "next": "14.2.35",
+      "on-headers": "^1.1.0",
+      "path-to-regexp": "^0.1.12",
+      "prismjs": "^1.30.0",
+      "send": "^0.19.0",
+      "serialize-javascript": "7.0.4",
+      "undici": "6.23.0",
+      "word-wrap": "^1.2.4",
+      "postcss": "^8.4.31",
+      "nodemailer": "7.0.11",
+      "jsondiffpatch": "0.7.2",
+      "ai": "5.0.52",
+      "zod": "3.25.76",
+      "redlock": "5.0.0-beta.2",
+      "@remix-run/node": "2.17.4",
+      "@remix-run/react": "2.17.4",
+      "@remix-run/express": "2.17.4",
+      "@remix-run/serve": "2.17.4",
+      "@remix-run/server-runtime": "2.17.4",
+      "@remix-run/dev": "2.17.4",
+      "@remix-run/router": "1.23.2"
     },
     "onlyBuiltDependencies": [
       "@depot/cli",