chore(deps): update vulnerable dependencies [security]

[lakoone]

What/Why/How?

Update vulnerable dependencies flagged by Dependabot and rebuild dist/:

• js-yaml 4.1.1 → 4.3.1 and 3.14.2 → 3.15.1
• fast-uri → 3.1.5, undici → 7.29.0, ip-address → 10.5.0
• brace-expansion → 1.1.18 / 2.1.4 / 5.0.9

Added a scoped override "pm2": { "js-yaml": "^4.3.1" } — pm2 (dev-only) pins js-yaml exactly and even its latest release (7.0.3) still pins a vulnerable 4.3.0. Remove the override when pm2 ships js-yaml >= 4.3.1.

Testing

• npm ci clean
• Jest suite: 19/19 passed
• npm run package rebuilds dist/ without errors (dist included in this PR — the bundled deps are the ones that run)

Additional context

Not covered here: npm audit still flags @opentelemetry/* and pm2 itself under the pinned @redocly/cli 2.31.2 — needs a cli bump, separate PR (see #126).