chore(deps): clear vulnerable transitive deps (tar, flatted)

Resolves open Dependabot security advisories for transitive npm
dependencies that have no direct manifest entry (so Dependabot cannot
auto-open fix PRs for them).

tar (6 x HIGH): an old tar@6.2.1 was pulled in via
ttf2woff2@4.0.5 -> node-gyp@9.4.1 (and node-gyp's
make-fetch-happen@10 -> cacache@16 chain). ttf2woff2 6+ switched to an
ESM/default export that breaks @vusion/webfonts-generator's callable
usage, so rather than bump ttf2woff2 we override its node-gyp to
^11.2.0 via a scoped resolution. That modernises the whole sub-tree
(node-gyp 11, make-fetch-happen 14/15, cacache 19/20) onto tar@7.5.16
while keeping ttf2woff2 at 4.0.5 so webfont generation still works.

flatted (1 x HIGH): bumped 3.4.1 -> 3.4.2 in the Electron runtime
(GHSA-rf6f-7fwh-wjgh).

Verified: yarn install builds ttf2woff2's native addon with node-gyp@11,
the webpack build regenerates the icon webfonts successfully, and
test:js-once passes 829/829.

paramiko (covered by #9927) and elliptic (no fix available upstream) are
intentionally left untouched.

Author: dpage

docs/en_US/release_notes_9_16.rst

@@ -24,6 +24,7 @@ Housekeeping
 ************
 
   | `Issue #10018 <https://github.com/pgadmin-org/pgadmin4/issues/10018>`_ -  Remove the EDB BigAnimal cloud deployment support.
+  | `Issue #10049 <https://github.com/pgadmin-org/pgadmin4/issues/10049>`_ -  Bump vulnerable transitive dependencies (tar, flatted) to clear security advisories.
 
 Bug fixes
 *********

runtime/yarn.lock

@@ -797,9 +797,9 @@ __metadata:
   linkType: hard
 
 "flatted@npm:^3.2.9":
-  version: 3.4.1
-  resolution: "flatted@npm:3.4.1"
-  checksum: 10c0/3987a7f1e39bc7215cece001354313b462cdb4fb2dde0df4f7acd9e5016fbae56ee6fb3f0870b2150145033be8bda4f01af6f87a00946049651131bbfca7dfa6
+  version: 3.4.2
+  resolution: "flatted@npm:3.4.2"
+  checksum: 10c0/a65b67aae7172d6cdf63691be7de6c5cd5adbdfdfe2e9da1a09b617c9512ed794037741ee53d93114276bff3f93cd3b0d97d54f9b316e1e4885dde6e9ffdf7ed
   languageName: node
   linkType: hard
 

web/package.json

@@ -165,7 +165,8 @@
     "ws": "^8.20.1",
     "qs": "^6.15.2",
     "@tootallnate/once": "^2.0.1",
-    "tar@npm:^7.5.4": "^7.5.15"
+    "tar@npm:^7.5.4": "^7.5.15",
+    "ttf2woff2/node-gyp": "^11.2.0"
   },
   "scripts": {
     "linter": "yarn run eslint -c .eslintrc.js .",