fix(deps): re-resolve svgo + fast-xml-parser + fast-uri to clear osv-scanner (#638) (#639)

osv-scanner (required 'Secrets, deps, and workflow scan') fails on main's
yarn.lock, ejecting every PR from the merge queue via the merge_group re-scan
(observed on #612, #616). Newly-published advisories on pre-existing deps — same
class as #636 (astro/brace-expansion), different packages:

  GHSA-2p49-hgcm-8545  svgo             4.0.1  -> 4.0.2   (CVSS 8.2)
  GHSA-8r6m-32jq-jx6q  fast-xml-parser  5.9.3  -> 5.10.1  (CVSS 8.7)
  GHSA-v2hh-gcrm-f6hx  fast-uri         3.1.3  -> 3.1.4   (CVSS 7.5)

All three re-resolve WITHIN their existing ranges (svgo/fast-uri transitive;
fast-xml-parser is ^5.7.0 direct, 5.10.1 is in-range), so this is yarn.lock-only
— no package.json / version-string / source change. All fix versions clean in OSV.

Verified: mise run security:deps -> 'No issues found' (exit 0);
yarn install --frozen-lockfile consistent; mise //docs:build green (68 pages).

Closes #638.

Author: isadeks