Update js-yaml past the merge-key CPU advisory

[Pixnop]

What changes

The overrides.js-yaml entry in package.json moves from the exact pin 4.3.1 to ^4.3.2, closing GHSA-2883-xcg3-v3hh (maxTotalMergeKeys does not limit CPU use for empty merge sources), Dependabot alert 15.

Before: every resolved copy of js-yaml sat at 4.3.1, inside the advisory's vulnerable range (>= 4.0.0, < 4.3.2).
After: every resolved copy sits at 4.3.2, the first patched version. npm ls js-yaml --all confirms all five copies (under electron-builder, electron-updater, and eslint) now resolve to 4.3.2.

Exposure

js-yaml is a transitive dependency only, pulled in by:

• electron-updater (runtime dependency), which uses it to parse the auto-update feed YAML files it downloads.
• electron-builder and eslint's @eslint/eslintrc (dev dependencies), used only during build and lint.

The launcher's own code never imports js-yaml:

$ grep -rn "js-yaml" src scripts tests
tests/config/electron-builder-icon-files.test.ts:32: * ... js-yaml is only a
tests/config/electron-binary-download-skip.test.ts:19: * here: js-yaml is only a transitive dependency of electron-updater.
tests/config/ymlBlock.ts:2:// each caller, on purpose: js-yaml is only a transitive dependency of
tests/config/release-checksums.test.ts:154:  // file GitHub refuses to parse. js-yaml is only a transitive dependency of

Those hits are comments explaining why the existing config tests deliberately read YAML files as text instead of importing js-yaml, to avoid an undeclared dependency. No player-supplied YAML is ever parsed at runtime by RiftLauncher's own code; the only runtime use is electron-updater parsing the update feed it fetches from our own release channel.

Testing

• npm ls js-yaml --all: all resolved copies at 4.3.2.
• npm audit --omit=dev: 0 vulnerabilities (was flagging js-yaml high before the bump).
• npm audit: 3 moderate, unrelated to this change (@vitest/mocker path traversal, dev-only, left untouched).
• npm run typecheck, npm run lint:ci (0 errors), npm run format:check: all clean.
• npm run test:coverage: 242 test files passed, 4461 tests passed, 2 skipped.
• npm run build: electron-vite build succeeded.

main is the default branch Dependabot watches, so alert 15 closes once this reaches main with the next promotion.