fix(deps): override undici to patched 7.28.0 to close GHSA-vmh5-mc38-953g (#2044)

CI's "Validate Package Dependencies" gate (pnpm audit --audit-level=high)
fails on GHSA-vmh5-mc38-953g — undici TLS certificate validation bypass via
dropped requestTls in the SOCKS5 ProxyAgent (vulnerable >=7.23.0 <7.28.0).

undici 7.27.2 is pulled transitively through the VS Code extension's publish
tooling: packages/vscode-objectstack > @vscode/vsce > cheerio > undici.

Pin via pnpm-workspace.yaml `overrides` (the repo's canonical location — pnpm
v10 ignores package.json `pnpm.overrides`). cheerio@1.2.0 declares undici
^7.19.0, so the override targets only the vulnerable range and forces ^7.28.0
(resolves to 7.28.0) — staying inside the 7.x major cheerio supports rather
than jumping to undici 8.x.

After the change `pnpm audit --audit-level=high` reports 0 high (exit 0) and
`turbo run build --filter=objectstack-vscode` still succeeds.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

pnpm-lock.yaml

@@ -24,8 +24,13 @@ onlyBuiltDependencies:
 #   - form-data: GHSA-hmw2-7cc7-3qxx (high) — CRLF injection via unescaped
 #     multipart field names. Pulled 4.0.5 transitively through @vscode/vsce;
 #     force the patched >=4.0.6 line. Fails `pnpm audit --audit-level=high` (CI).
+#   - undici: GHSA-vmh5-mc38-953g (high) — TLS cert validation bypass via
+#     dropped requestTls in SOCKS5 ProxyAgent. Pulled 7.27.2 through
+#     @vscode/vsce > cheerio (declares undici ^7.19.0); force the patched
+#     7.28.0 line (stays in the 7.x major cheerio supports). CI audit gate.
 overrides:
   esbuild: '>=0.28.1'
   'minimatch@<10.2.3': '10.2.3'
   'tar@>=2.0.0 <7.5.11': '^7.5.11'
   'form-data@<4.0.6': '>=4.0.6'
+  'undici@>=7.23.0 <7.28.0': '^7.28.0'