fix: resolve all 35 npm security vulnerabilities via overrides

Added npm overrides in package.json to force patched versions of
vulnerable transitive dependencies without breaking direct deps:

- @tootallnate/once >= 3.0.1 (Incorrect Control Flow Scoping)
- esbuild >= 0.28.0 (dev server CORS bypass)
- lodash >= 4.18.1 (Prototype Pollution, Code Injection)
- nth-check >= 3.0.1 (ReDoS)
- postcss >= 8.5.14 (line return parsing error, XSS)
- serialize-javascript >= 7.0.5 (RCE, DoS)
- tmp >= 0.2.5 (symlink arbitrary write)
- underscore >= 1.13.8 (unlimited recursion DoS)
- undici >= 8.2.0 (data leak, CRLF injection, memory exhaustion)
- webpack-dev-server >= 5.2.3 (source code theft via CORS)

Reduces audit report from 35 vulnerabilities to 0.

Author: techwallahexplorer