chore(deps): patch dompurify advisory and bump minors (#40)

- docs: bump mermaid ^11.16.0 (pulls in dompurify >3.4.10, clears
  GHSA-cmwh-pvxp-8882), vitest 4.1.9, vue ^3.5.39
- solution: bump @cap-js/cds-types ^0.18.0 (types-only)

npm audit results:
- solution/MyHANAApp: 0 vulnerabilities
- docs: 5 -> 4 (dompurify cleared; remaining vite/esbuild/vitepress
  chain is dev-server-only and gated on vitepress 2.0 which is still
  alpha -- deferred)

Verified: docs npm test (23/23) and npm run docs:build pass; solution
npx eslint is unchanged from baseline (pre-existing UI5 OPA test
warnings only).

Not bumped: @agentmarkup/vite 0.4.0 -> 0.5.0 (pre-1.0 minor, needs
changelog review in a follow-up).

Co-authored-by: Thomas Jung <12159356+jung-thomas@users.noreply.github.com>

Author: jung-thomas