Bump dompurify to 3.4.0 (GHSA-39q2-94rc-95cp)

Fixes a medium-severity advisory where `ADD_TAGS` as a function bypassed
`FORBID_TAGS` due to short-circuit evaluation, letting forbidden tags
through when both config options were set. Not exploitable in Annotask's
current usage (we don't pass `ADD_TAGS` as a function) but bumping keeps
the lockfile audit-clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: kurtstohrer

package.json

@@ -83,7 +83,7 @@
     "@types/ws": "^8.18.1",
     "@vitejs/plugin-vue": "^5.0.0",
     "axe-core": "4.11.1",
-    "dompurify": "^3.3.3",
+    "dompurify": "^3.4.0",
     "html2canvas-pro": "2.0.2",
     "js-yaml": "^4.1.1",
     "jsdom": "^29.0.1",