Fix non-doc Dependabot security alerts

[shanghaikid]

Summary

• update root dependency resolutions for protobufjs, form-data, minimatch, brace-expansion, Babel helpers, fast-xml-builder, and diff
• update non-doc example locks/manifests for Express/qs/cookie, LangSmith, protobufjs, and thrift
• keep docs dependencies untouched

Verification

• npm run build
• yarn audit --json | jq ... (root, examples/milvus, examples/LangChain)
• yarn audit --json | jq ... (examples/nextjs)
• npm audit --json (examples/nextjs)
• npm run build (examples/nextjs, rerun with network access after Google Fonts fetch failed in sandbox)
• git diff --check

[sre-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: shanghaikid

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.55%. Comparing base (310e022) to head (b1cd2d0).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #569   +/-   ##
=======================================
  Coverage   97.55%   97.55%           
=======================================
  Files          63       63           
  Lines        5023     5023           
  Branches     1419     1476   +57     
=======================================
  Hits         4900     4900           
+ Misses        123      118    -5     
- Partials        0        5    +5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.