security(frontend): pin js-yaml to 5.4.1+

Raise the js-yaml override from ^5.2.3 to ^5.4.1. Versions up to 5.4.0
do not count empty mappings towards maxTotalMergeKeys, so a small YAML
file can keep the CPU busy for a long time. js-yaml is a dev-only
transitive dependency of eslint and only parses our own ESLint configs.

frontend/package-lock.json

@@ -5141,9 +5141,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "5.2.3",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.3.tgz",
-      "integrity": "sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==",
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.2.tgz",
+      "integrity": "sha512-m+aqu+LwO1O6sIopafj8HUVl5aawITwZQe/yHpMCKjaWBaA/d07B/QdMb3529REftiU+RMMHL3Vlsw3hON7vWg==",
       "dev": true,
       "funding": [
         {

frontend/package.json

@@ -61,7 +61,7 @@
   "overrides": {
     "minimatch": "^10.2.1",
     "brace-expansion": "^5.0.9",
-    "js-yaml": "^5.2.3",
+    "js-yaml": "^5.4.1",
     "nanoid": "^3.3.18",
     "react-router": "7.18.2"
   },