LTS-4004: bump form-data to 4.0.6 — fixes CRLF injection (GHSA-hmw2-7cc7-3qxx)

form-data through 4.0.5 concatenates field names/filenames into the
Content-Disposition header without escaping CR, LF, or " (CWE-93, CVSS 7.5).
Patched in 4.0.6, which escapes them per the WHATWG multipart algorithm.

Lockfile-only bump of the transitive dev-dependency form-data 4.0.4 -> 4.0.6
(adds nested hasown@2.0.4, the sole new sub-dependency; every other 4.0.6
requirement is already satisfied by the existing tree). No package.json or
source changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: prasadthx