fix(deps): remove malicious tree-sitter-erlang, fix 3 moderate vulns

Removes the WhatsApp/tree-sitter-erlang devDependency flagged as
malware (GHSA-rphw-c8qj-jv84, CWE-506). The committed WASM in
grammars/ was validated clean (correct export name, no disallowed
imports) — Erlang grammar support is unaffected.

Also runs npm audit fix to bump hono (→4.12.25), protobufjs (→7.5.8),
and qs (→6.15.2) to their patched versions. All three were transitive
deps; no direct-dependency changes required.

See scripts/build-wasm.ts for instructions on rebuilding the Erlang
WASM from a safe source if needed.

Author: carlos-alm

package-lock.json

@@ -161,7 +161,6 @@
     "tree-sitter-cuda": "^0.21.1",
     "tree-sitter-dart": "^1.0.0",
     "tree-sitter-elixir": "^0.3.5",
-    "tree-sitter-erlang": "github:WhatsApp/tree-sitter-erlang#semver:*",
     "tree-sitter-fsharp": "https://github.com/ionide/tree-sitter-fsharp/archive/refs/tags/0.3.0.tar.gz",
     "tree-sitter-gleam": "github:gleam-lang/tree-sitter-gleam",
     "tree-sitter-go": "^0.25.0",

package.json

@@ -211,7 +211,10 @@ const grammars = [
   { name: 'tree-sitter-clojure', pkg: 'tree-sitter-clojure', sub: null },
   { name: 'tree-sitter-julia', pkg: 'tree-sitter-julia', sub: null },
   { name: 'tree-sitter-r', pkg: '@eagleoutice/tree-sitter-r', sub: null },
-  { name: 'tree-sitter-erlang', pkg: 'tree-sitter-erlang', sub: null },
+  // tree-sitter-erlang: the WhatsApp/tree-sitter-erlang npm package was flagged as malware
+  // (GHSA-rphw-c8qj-jv84). The grammar WASM is committed in grammars/ and was validated
+  // clean. To rebuild it, manually install github:the-mikedavis/tree-sitter-erlang, add this
+  // entry back, run build:wasm, validate the output, then remove the dep and this entry again.
   { name: 'tree-sitter-solidity', pkg: 'tree-sitter-solidity', sub: null },
   { name: 'tree-sitter-objc', pkg: 'tree-sitter-objc', sub: null },
   { name: 'tree-sitter-cuda', pkg: 'tree-sitter-cuda', sub: null },