fix: clear Dependabot security alerts via direct bumps and overrides

[AaronFeledy]

Summary

Clears the remaining Dependabot security alert classes on lando/core without any drive-by majors that need real API work.

Stacked on #457 (npm tooling majors + tar override). Merge that first — this branch contains its commits, so the diff will shrink to just this work once #457 lands.

Direct runtime dep bumps

package	before	after
axios	^1.5.1	^1.18.0
js-yaml	^4.1.0	^4.3.1
lodash	^4.17.21	^4.18.0
nanoid	^3	^3.3.17
node-forge	^1.3.1	^1.4.0

All stay within their existing major, so no code changes needed.

Overrides for sticky transitives

These advisories sit in packages we don't depend on directly, so a range bump alone won't move them. Each is pinned to its patched floor:

tar ^7.5.22 · undici ^6.28.0 · form-data ^4.0.6 · fast-uri ^3.1.5 · follow-redirects ^1.16.0 · flatted ^3.4.2 · immutable ^5.1.8 · postcss ^8.5.23 · ip-address ^10.3.1 · serialize-javascript ^7.0.5 · tmp ^0.2.6 · lodash-es ^4.18.0

Version-targeted where multiple majors coexist in the tree, so nothing gets dragged across a major boundary:

• minimatch@3 3.1.5, @4 4.2.5, @5 5.1.9, @8 8.0.7, @9 9.0.9
• brace-expansion@1 ^1.1.18, @2 ^2.1.4
• picomatch@2 ^2.3.2, @4 ^4.0.4
• nanoid@3 ^3.3.17, @5 ^5.1.6

The targeting matters: a blanket picomatch override downgrades @yao-pkg/pkg and tinyglobby from 4.x to 2.x (which would break npm run pkg), and a blanket brace-expansion pushes every minimatch 3.x consumer onto 2.x.

Example lockfiles

examples/command, examples/entrypoint, examples/mounts: fast-uri 3.1.2 → 3.1.5 and find-my-way 9.6.0 → 9.7.0, pinned as direct deps (same approach as #482). All three still npm ci clean.

Cross-major overrides, verified

Three overrides cross a major boundary. All are CJS and were smoke-tested against their actual consumers:

• tmp 0.0.33 → 0.2.7 (external-editor) — tmp.fileSync() still returns {name, removeCallback}
• ip-address 9.0.5 → 10.4.0 (socks) — Address4/Address6 construct and format correctly
• serialize-javascript 6.0.0 → 7.1.0 (mocha, dev-only) — serialize() output unchanged; needs Node >=20, which the new engine floor satisfies

Docs

• CHANGELOG.md entries for the direct bumps and the overrides
• AGENTS.md: noted that npm test on Node 24 dies inside mocha's nested glob 7.2.0 with TypeError: Cannot convert a Symbol value to a string before any test runs. Pre-existing on main, not caused by this PR, but it reads like a real test failure and cost time to diagnose.

Testing

• 292 unit tests passing, lint clean
• npm ls reports no invalid or unmet resolutions
• All three example lockfiles validated with npm ci --dry-run

Intentionally deferred

• yargs-parser major and glob major — compatibility risk, parked deliberately
• @octokit/rest ^19 → ^22 — three moderate ReDoS alerts, but it's a major with real API churn
• mocha / nyc majors (diff, uuid alerts) — dev-only
• vite / esbuild dev-server alerts — high severity but dev-only via vitepress, and npm audit reports no fix available without a vitepress major

Remaining npm audit after this PR: 18 (1 high, 14 moderate, 3 low), all in the deferred list above and none in shipped runtime code.

[netlify]

❌ Deploy Preview for lando-core failed. Why did it fail? →

Name	Link
🔨 Latest commit	1c12e2c
🔍 Latest deploy log	https://app.netlify.com/projects/lando-core/deploys/6a7936c6a54f0d00083221a3

[AaronFeledy]

Closing as superseded/conflicting.

#457 already merged the security dep work onto main (9e70ca3). This branch diverged, is dirty vs main, and CI is red. Any remaining alerts should be a fresh PR off current main, not this one.