chore(deps-dev): remediate npm dev-dependency security advisories

[nawforce]

Summary

Lockfile-only remediation for the five open Dependabot security alerts on this repo. No package.json changes, no direct dependency changes — only npm/package-lock.json.

All five are transitive, development-only dependencies. None ship in the published parser's runtime dependency set.

Alert	Severity	Path / exposure	Fix
brace-expansion	high	ESLint / typescript-eslint / Jest minimatch chains	→ 5.0.8, 2.1.2, 1.1.16
tmp	high	patch-package → tmp; install/build-time filesystem exposure	→ 0.2.7
js-yaml	medium	Jest coverage config chain; build/test-only YAML parsing	→ 3.15.0
@babel/core	low	Jest transforms; local arbitrary-file-read during tests	→ 7.29.7
esbuild	low	rollup-plugin-esbuild; requires running the Windows dev server, which this repo does not do	→ 0.28.1

None of the open Dependabot PRs (#133–#138) address these.

Verification

• Full npm run init && npm run build passed: 93 npm tests, 92 JVM tests
• Lockfile confirmed to resolve the patched versions listed above

Known caveat

npm audit is not fully clean after this change. A newer brace-expansion OOM advisory affects older majors retained through Jest, and npm's suggested --force fix is an unsafe Jest downgrade. That is deliberately left alone and should be tracked separately rather than forced here.