Update js-yaml development dependencies

[kpumuk]

Dependabot cannot update the two vulnerable js-yaml copies in the root lockfile because it treats the transitive nyc dependency edge as a conflict. Refresh the lockfile within the existing declared ranges so nyc resolves js-yaml 3.15.1 and ESLint resolves js-yaml 4.3.1.

This keeps nyc 15.1.0 and the project's existing Node.js compatibility while addressing these open Dependabot alerts:

• #290 and #291: YAML merge-key chains can force quadratic CPU consumption (GHSA-52cp-r559-cp3m, CVE-2026-59869).
• #307 and #308: quadratic CPU consumption in !!omap resolution (GHSA-5p4m-2wfm-xmqj).

• Did you create an Apache Jira ticket? (Request account here, not required for trivial changes) — Skipped for this lockfile-only dependency update.
• If a ticket exists: Does your pull request title follow the pattern "THRIFT-NNNN: describe my issue"? — No ticket exists.
• Did you squash your changes to a single commit? (not required, but preferred)
• Did you do your best to avoid breaking changes? If one was needed, did you label the Jira ticket with "Breaking-Change"?
• If your change does not involve any code, include [skip ci] anywhere in the commit message to free up build resources. — Not applicable; CI should validate the updated dependency resolution.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.