Fix remaining npm audit vulnerabilities via overrides

[TwitchBronBron]

Summary

• After the recent `qs` bump (Bump qs from 6.14.2 to 6.15.3 #1766), `npm audit` still reported 7 vulnerabilities: brace-expansion, js-yaml, fast-uri (all high), @babel/core (low), and the already-allowlisted uuid/istanbul-lib-processinfo/nyc chain (moderate)
• All are pulled in exclusively through devDependencies (eslint, mocha, nyc, ajv) — none touch the published package
• No non-major version resolves brace-expansion/js-yaml/@babel/core/fast-uri through normal resolution, so pins them via the existing `overrides` block (same pattern already used for serialize-javascript)
• The remaining moderate uuid finding stays allowlisted in audit-ci.jsonc (unreachable v3/v5/v6 buffer-bounds path — both consumers only call v4())

Test plan

• `npm run audit` passes
• `npm run build` passes
• `npm run lint` passes
• `npm run test` passes (2979 passing)

🤖 Generated with Claude Code