fix(PT9-1362): bump vulnerable dev dependencies to patched versions

[edvardg]

Change Summary

What does this PR change?
Remediates all 18 open High-severity Dependabot alerts (the ticket listed 17; the live API returned 18). All affected packages are transitive dev tooling (ESLint, Jest, typescript-eslint stacks) — @1inch/byte-utils publishes no runtime dependencies, so the library artifact is unchanged.

Adds a pnpm-workspace.yaml with a range-keyed overrides: section (the same convention used across sibling 1inch repos; this repo had no overrides mechanism before), all staying within current majors:

• brace-expansion 1.1.12 → 1.1.18, 2.0.2 → 2.1.4 — DoS CVEs
• flatted 3.3.3 → 3.4.4 — unbounded recursion / prototype pollution CVEs
• js-yaml 3.14.1 → 3.15.1, 4.1.0 → 4.3.1 — quadratic CPU DoS
• minimatch 3.1.2 → 3.1.5, 9.0.5 → 9.0.9 — ReDoS CVEs
• picomatch 2.3.1 → 2.3.2, 4.0.2 → 4.0.5 — ReDoS CVE

Live alert list: open High alerts

Related Issue/Ticket:
PT9-1362

Testing & Verification

How was this tested?

• Unit tests
• Integration tests
• Manual testing (describe steps)
• Verified on staging

Steps:

• pnpm install re-resolved the lockfile; verified no vulnerable resolutions remain (all nine bumped lines land on patched versions)
• Lockfile churn is limited to the nine packages and their consumers
• Build, typecheck, lint, and unit tests all pass — 12/12 tests

Risk Assessment

Risk Level:

• Low - Minor changes, no operational impact
• Medium - Moderate changes, limited impact, standard rollback available
• High - Significant changes, potential operational impact, complex rollback

Risks & Impact

• Dev tooling only — lint/test/build stacks; the published library has no runtime dependencies and is unaffected