chore(deps): refresh the lockfiles to close 55 security alerts

[JoshuaPariona]

Summary

Enabling Dependabot alerts surfaced 64 open alerts (4 critical, 45 high,
15 medium) across 18 packages. 55 of them close with lockfile changes alone: the
patched versions already satisfy the ranges their dependents ask for, so this
re-resolves them in place and touches no package.json.

None of this reaches people who install the package. The published package
declares no dependencies, and every affected package is tooling reached
through expo, metro, jest or babel. They are visible in the repo's
Security tab, which is why they are worth closing.

Why Dependabot's version PRs did not do this: it proposes bumps for the
dependencies we declare, and these are transitive. yarn upgrade <pkg> does not
move transitive ones in yarn 1 either (it exits without changing anything), so
the entries were dropped from each lockfile and re-resolved with yarn install.

Closed here

Package	Lockfile	From → to
handlebars (critical)	root	4.7.9 → 4.7.10
shell-quote (critical)	root, example	1.10.0 → 1.12.0
@xmldom/xmldom ×23	example	0.8.13 → 0.8.15, 0.9.10 → 0.9.12
brace-expansion ×8	root, example	1.1.16 → 1.1.21, 2.1.4 → 2.1.7, 5.0.x → 5.0.12
fast-uri ×7	root	3.1.3 → 3.1.8
js-yaml ×4	root, example	3.15.0 → 3.15.2, 4.3.0 → 4.3.2
browserslist, compression, nanoid, postcss, source-map-js, baseline-browser-mapping	example, root	patch or minor, within range

Still open: 9 alerts, 6 packages

None can be closed here without forcing a major version or because no patched
release exists yet. All are pulled by build or test tooling:

Package	Needs	Pulled by	Why not here
node-forge ×2	—	expo → @expo/cli	no patched version exists
braces	—	metro-file-map → micromatch	no patched version exists
sprintf-js	—	babel-plugin-istanbul → argparse	no patched version exists
uuid ×2	11.1.1	expo → @expo/config-plugins → xcode	xcode asks for ^7; a major jump through a resolution
image-size ×2	2.0.3	metro	metro asks for ^1; a major jump
decode-uri-component	0.5.0	expo-router → query-string	query-string asks for ^0.2; a major jump

Type of change

• fix — bug fix (no public API change)
• feat — new backward-compatible API
• Breaking change to the public API or the RN ↔ WebView bridge contract
• docs / chore / ci / test — no runtime change

How was this tested?

yarn lint, yarn typecheck and yarn test (156) pass, and the example
type-checks, both against the new lockfiles installed with --frozen-lockfile.
The example's Android and iOS builds in this PR's CI are the real check: several
of the bumps (browserslist 4.28 → 4.29, postcss, baseline-browser-mapping)
sit in the example's bundling path.

• iOS (example app) — covered by the CI build, not run by hand
• Android (example app) — covered by the CI build, not run by hand

Checklist

• yarn lint, yarn typecheck, and yarn test all pass.
• Public API changes are documented — there are none.
• Bridge changes keep all three sides in sync — no bridge change here.
• CHANGELOG.md updated under ## [Unreleased] — not applicable: nothing
  ships to consumers from this PR.
• I did not bump the version.