fix(deps): patch the advisories Stryker introduced, plus a newly disclosed one

The Security Audit job failed on PR #359 with 7 findings. Attribution:

- minimatch 10.x (3x High, ReDoS) via @stryker-mutator/core
- ajv 8.x (Moderate, ReDoS via `$data`) via @stryker-mutator/core
- @babel/core (Low, arbitrary file read) via @stryker-mutator/core

Those three arrived with the nightly mutation runner added in this branch, so
they are ours to fix. Each override is version-scoped to the line already
present rather than lifted across a major, matching the existing entries.

The advisory for @babel/core names 7.29.1 as the first patched release, but
that version was never published — the 7.29.x line goes 7.29.0 -> 7.29.6 ->
7.29.7 — so the override pins the head of the 7.x line instead.

Also patches dompurify (Low) via docs > mermaid, which is NOT from this branch:
the advisory was disclosed after main's last green audit, so main is affected
too. Included because it blocks this PR's audit job and the fix is a
version-scoped override in the same style; `build:docs` is verified against it.

`pnpm audit` now exits 0, with only the pre-existing GHSA-mh99-v99m-4gvg
ignore remaining. typecheck/lint/test 16/16, build:docs 9/9.

Author: btravers