fix(deps): resolve 9 Dependabot alerts in js/

[DeepDiver1975]

Resolves all 9 open Dependabot alerts. Every alert is a transitive, dev-scope dependency in js/package-lock.json; all are remediated via a single overrides block in js/package.json.

Fixed

Package	Alert(s)	Old → New	Needs	Advisory
js-yaml	#71 (med)	3.14.2 → 3.15.0	≥ 3.15.0	Quadratic-complexity DoS in merge-key handling
lodash	#62 (high), #63 (med)	4.17.23 → 4.18.1	≥ 4.18.0	Code injection via _.template; prototype pollution in _.unset/_.omit
merge	#14 (high)	1.2.1 → 2.1.1	≥ 2.1.1	Prototype pollution (major bump)
minimatch	#54 (high)	3.0.4 / 3.1.2 → 3.1.5	≥ 3.1.3	ReDoS in matchOne()
minimist	#30 (crit), #9 (med)	0.0.10 → 0.2.4	≥ 0.2.4	Prototype pollution — scoped optimist > minimist override; root minimist was already 1.2.8 and untouched
postcss	#66 (med), #35 (med)	7.0.39 → 8.5.16	≥ 8.5.10	XSS via unescaped </style>; line-return parsing (major bump — no 7.x patch exists)

Test plan

• npm install — clean, resolutions confirmed at/above each threshold.
• npm run build (gulp lint + build + uglify) — ✅ green.
• npm test (karma + jasmine, headless Chrome) — ✅ 22/22 passing.

The postcss 7→8 and merge 1→2 major bumps were the primary risk; build and tests confirm no breakage. Verified locally on Node v18.

Out of scope

npm audit reports 5 further issues (brace-expansion, es5-ext, micromatch, socket.io-parser, ws) that are not in the current Dependabot alert set and are not addressed here.

[DeepDiver1975]

CI note: the JS Unit check failed on the first run with ChromeHeadless has not captured in 5000 ms — the pre-existing flaky Chrome-launch timeout also being addressed in #544, unrelated to these dependency bumps. Re-ran the job and it passed 22/22. All checks now green.