Fix 23 Dependabot alerts on transitive tooling dependencies

[erwanMarmelab]

Problem

44 Dependabot alerts are open on the repository. 23 of them concern transitive
dependencies of the build tooling (lerna, nx, eslint, cypress, postcss) and can
be fixed without touching a single line of code.

Solution

Bumps 11 packages: js-yaml (6 alerts), tar (4), qs (3), brace-expansion (2),
postcss-selector-parser (2), minimatch, ajv, uuid, yaml, @humanfs/node
and ejs (1 each). Mostly plain lockfile re-resolutions; five resolutions cover the
parents whose declared range blocks the patch, scoped by parent or bare rather than by
version so they survive future re-pins.

uuid jumps 8.3.2 → 11.1.1 — the advisory has no lower bound, so leaving 8.3.2 in the
tree kept the alert open. Its only consumer uses just the named v4 export.

No runtime dependency of any published package changes.

Additional Checks

• The PR targets master for a bugfix or a documentation fix, or next for a feature
• [ ] The PR includes unit tests — n/a, lockfile-only change with no API or runtime behaviour to test
• [ ] The PR includes one or several stories — n/a, no component involved
• The documentation is up to date — unchanged, nothing user-facing