fix(deps): bump fast-xml-parser to v5.9.3 to clear XMLBuilder injection advisory

Corrects issue #108, whose premise was inaccurate: 4.5.3 patches none of the
advisories affecting the pinned range, and the lockfile already resolved
^4.5.1 to 4.5.6 (covering the in-range fixes). The one remaining open alert,
GHSA-gh4j-gqv2-49f6 / CVE-2026-41650 (XMLBuilder comment & CDATA injection),
is patched only in 5.7.0 with no 4.x backport -- the v4 line is EOL for
security fixes -- so clearing it requires a major bump, not the in-range
refresh the issue assumed.

- packages/pipeline: fast-xml-parser ^4.5.1 -> ^5.9.3 (resolves 4.5.6 -> 5.9.3)
- The pipeline uses XMLParser only (src/indesign/xml.ts); the vulnerable
  XMLBuilder API is never called, so real-world exposure was already nil.
  v5's XMLParser accepts the same options, so no code changes were needed.

Verified: pnpm typecheck, 133/133 vitest tests, and tsc build all pass; the
React generator snapshot is byte-identical (no behavioural change).

Closes #108

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Paul Mulligan

packages/pipeline/package.json

@@ -42,7 +42,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "fast-xml-parser": "^4.5.1",
+    "fast-xml-parser": "^5.9.3",
     "fflate": "^0.8.2",
     "pdfjs-dist": "^6.0.227",
     "pngjs": "^7.0.0",