Bump js-yaml to a patched version

Adds an npm override pinning the transitive js-yaml dependency to its
patched version:

- js-yaml 4.2.0 -> 4.3.0 (GHSA-52cp-r559-cp3m, CVE-2026-59869)

Stays within the current major version line.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 578b6525-9314-4451-8a03-97df3e5f04cd

Author: Copilot

package-lock.json

@@ -19,6 +19,7 @@
     "eslint-plugin-json": "^3.1.0"
   },
   "overrides": {
-    "lodash": ">=4.18.0"
+    "lodash": ">=4.18.0",
+    "js-yaml": "^4.3.0"
   }
-}
+}