fix(security): clear HIGH advisories in dependency tree

pnpm audit reported 5 HIGH advisories; trivy (MegaLinter) has been
failing main since 2026-08-17 with 3 of them:

- brace-expansion 5.0.7 -> 5.0.9 (CVE-2026-14257, CVE-2026-69152)
- nanoid 3.3.16 -> 3.3.18 (CVE-2026-67213)
- undici 7.28.0 -> 8.10.0 in tools/danger (CVE-2026-13697)

Several existing range-pins in pnpm-workspace.yaml were now below
current fix floors and kept vulnerable versions locked; refresh them:
- brace-expansion <1.1.13 pin -> <1.1.18 at 1.1.18
- brace-expansion >=2 <2.0.3 pin -> <2.1.4 at 2.1.4
- fast-uri >=3.1.2 -> >=3.1.5
- js-yaml >=4.1.1 -> >=4.3.1

pnpm audit --audit-level=high is now clean (6 moderate / 2 low remain,
below the HIGH,CRITICAL gate).

Author: ulises-jeremias