fix(deps): upgrade jest and accept unfixable js-yaml baseline (#694)

* fix(deps): upgrade jest to 30.4.1 to reduce transitive CVE surface

Upgrades jest from 30.3.0 to 30.4.1, clearing the @babel/core low-severity
transitive finding. The js-yaml medium finding via @istanbuljs/load-nyc-config
is unfixable upstream (pinned to ^3.13.1) and is accepted via baseline.

Closes #693

* chore: add cve-lite baseline for unfixable js-yaml transitive dev dep

Accepts GHSA-h67p-54hq-rp68 (js-yaml@3.14.2, medium) as a known baseline.
The finding is only reachable through jest -> babel-plugin-istanbul ->
@istanbuljs/load-nyc-config, which pins js-yaml@^3.13.1 with no upstream fix.

Future scans will suppress this finding and only fail on new introductions.

Author: sonukapoor

.cve-lite/baseline.json

@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "createdAt": "2026-06-17T04:48:33.541Z",
+  "findings": [
+    {
+      "name": "js-yaml",
+      "version": "3.14.2",
+      "advisoryIds": [
+        "GHSA-h67p-54hq-rp68"
+      ]
+    }
+  ]
+}