chore(deps): patch 4 Dependabot vulnerabilities via pnpm overrides

GitHub flagged 4 open alerts on default branch:
- #126 tmp <0.2.6 (high)  — path traversal in @vscode/vsce devDep
- #125 qs <6.15.2 (medium) — DoS in express 4 body-parser chain
- #124 uuid <11.1.1 (medium) — buffer bounds check (Azure SDK devDep)
- #100 postcss <8.5.10 (medium) — already patched (8.5.15 present)

Apply targeted version-range overrides so only the vulnerable ranges
are bumped (existing transitive consumers above the fix line are
untouched):

  qs@<6.15.2   -> ^6.15.2  (was 6.14.2 via express@4 in @object-ui/cli)
  tmp@<0.2.6   -> ^0.2.6   (was 0.2.5 via @vscode/vsce)
  uuid@<11.1.1 -> ^11.1.1  (was 8.3.2 via @azure/msal-node;
                            unifies with mermaid's 14.x consumer too)

After pnpm install, 'pnpm why -r' confirms:
- tmp now 0.2.7
- qs collapsed to a single version 6.15.2
- uuid collapsed to a single version 11.1.1

Builds verified: app-shell + plugin-chatbot both green.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: os-zhuang

package.json

@@ -103,7 +103,10 @@
       "react-dom": "19.2.6",
       "@types/react": "19.2.15",
       "@types/react-dom": "19.2.3",
-      "dompurify": "^3.4.5"
+      "dompurify": "^3.4.5",
+      "qs@<6.15.2": "^6.15.2",
+      "tmp@<0.2.6": "^0.2.6",
+      "uuid@<11.1.1": "^11.1.1"
     }
   },
   "dependencies": {