build(deps-dev): npm audit fix for dev-only advisories (#3456)

Run `npm audit fix` to move transitive devDependencies onto patched
releases already inside their declared semver ranges. Lockfile only --
package.json is unchanged and no overrides are needed.

Clears 9 of 14 advisories (4 low, 4 high, 1 moderate):

  brace-expansion  1.1.15/2.1.1/5.0.6 -> 1.1.16/2.1.2/5.0.7  (DoS)
  immutable        5.1.6  -> 5.1.9   (trie overflow DoS)
  js-yaml          4.2.0  -> 4.3.0   (quadratic CPU)
  hono             4.12.25 -> 4.12.31 (XSS, cross-request leak)
  body-parser      1.20.5/2.2.2 -> 1.20.6/2.3.0

Author: madhavilosetty-intel