chore(security): pin transitive form-data to >=4.0.6 (GHSA-hmw2-7cc7-3qxx) (#1970)

form-data@4.0.5 (CRLF injection via unescaped multipart field names, high)
was pulled in transitively through @vscode/vsce in packages/vscode-objectstack.
This tripped `pnpm audit --audit-level=high` — the `Validate Package
Dependencies` CI gate — red on every PR.

Add a pnpm-workspace.yaml override forcing the patched >=4.0.6 line (same
mechanism already used for the esbuild/minimatch/tar pins). `pnpm audit
--audit-level=high` now reports 0 high (only 2 low + 6 moderate remain).
Lockfile bumps form-data 4.0.5 → 4.0.6; no other resolution changes.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: os-zhuang

.changeset/form-data-cve.md

@@ -0,0 +1,4 @@
+---
+---
+
+chore(security): pin transitive `form-data` to `>=4.0.6` (GHSA-hmw2-7cc7-3qxx, high — CRLF injection via unescaped multipart field names). `4.0.5` was pulled in through `@vscode/vsce`; added a `pnpm-workspace.yaml` override so `pnpm audit --audit-level=high` (the `Validate Package Dependencies` CI gate) passes. No package version impact.

pnpm-lock.yaml

@@ -21,7 +21,11 @@ onlyBuiltDependencies:
 # pins must live here (previously orphaned in package.json: minimatch, tar).
 #   - esbuild: GHSA-gv7w-rqvm-qjhr (high). tsup/tsx/vite pulled 0.27.7 / 0.28.0
 #     (< 0.28.1); force the patched line everywhere.
+#   - form-data: GHSA-hmw2-7cc7-3qxx (high) — CRLF injection via unescaped
+#     multipart field names. Pulled 4.0.5 transitively through @vscode/vsce;
+#     force the patched >=4.0.6 line. Fails `pnpm audit --audit-level=high` (CI).
 overrides:
   esbuild: '>=0.28.1'
   'minimatch@<10.2.3': '10.2.3'
   'tar@>=2.0.0 <7.5.11': '^7.5.11'
+  'form-data@<4.0.6': '>=4.0.6'