fix: resolve test-app dependabot alerts

The postcss/uuid overrides added in #464 stopped applying once test-app
ended up nested under the repo-root pnpm-workspace.yaml: pnpm only honors
overrides from a workspace root, so test-app's package.json `pnpm.overrides`
were silently ignored and the lockfile drifted back to vulnerable versions.

Move the overrides into a dedicated examples/test-app/pnpm-workspace.yaml so
test-app is its own pnpm root and the overrides are honored, and add scoped
overrides for the two remaining alerts:

- postcss   8.4.49 -> 8.5.12  (XSS in CSS stringify)
- uuid      7.0.3  -> 14.0.0  (missing buffer bounds check)
- ws@8      8.20.0 -> 8.21.0  (uninitialized memory disclosure)
- brace-expansion@5  5.0.5 -> 5.0.6  (ReDoS / max bypass)

ws and brace-expansion overrides are scoped to the vulnerable majors so the
non-vulnerable ws@7 / brace-expansion@1 copies in the tree are left untouched.

Author: thymikee

examples/test-app/package.json

@@ -26,12 +26,5 @@
   "devDependencies": {
     "@types/react": "~19.2.2",
     "typescript": "~5.9.2"
-  },
-  "pnpm": {
-    "overrides": {
-      "@xmldom/xmldom": "0.8.13",
-      "postcss": "8.5.12",
-      "uuid": "14.0.0"
-    }
   }
 }

examples/test-app/pnpm-lock.yaml

@@ -0,0 +1,6 @@
+overrides:
+  '@xmldom/xmldom': 0.8.13
+  postcss: 8.5.12
+  uuid: 14.0.0
+  ws@8: ^8.20.1
+  brace-expansion@5: ^5.0.6