fix(deps-dev): resolve high severity advisories in the scripts lockfile

[jdrouet]

Runs npm audit fix in scripts/, bumping four transitive packages:

package	from	to
brace-expansion	2.1.0	2.1.3
nanoid	3.3.15	3.3.16
postcss	8.5.16	8.5.25
svgo	4.0.1	4.0.2

Advisories cleared

advisory	package	summary
GHSA-r28c-9q8g-f849	postcss	Path traversal in previous source map auto-loading (sourceMappingURL) leads to arbitrary .map file disclosure
GHSA-2p49-hgcm-8545	svgo	removeScripts plugin leaves some executable scripts intact
GHSA-3jxr-9vmj-r5cp	brace-expansion	DoS via exponential-time expansion of consecutive non-expanding {} groups

postcss and svgo arrived with the mjml 5 bump in #653, which pulled in the PostCSS/cssnano chain.

Knowingly left open

GHSA-mh99-v99m-4gvg (brace-expansion, patched in 5.0.8) is not fixed here. The chain is mjml → mjml-cli → glob/minimatch → brace-expansion, and mjml-cli has no release that unpins the vulnerable range — npm audit reports it as mjml-cli <=5.2.2. It needs an upstream fix first; npm audit fix --force would only "resolve" it by downgrading mjml.

Scope and verification

Lockfile-only, and it only affects the tooling that regenerates the comparison fixtures — nothing here ships to users.

Regenerating the whole of packages/mrml-core/resources/compare/ against the new lockfile produces byte-identical output (0 files changed), so resources check stays green.

[jdrouet-datadog-monitor]

⚠️ Warnings

🚦 1 Pipeline job failed

commit-lint | Validate PR title     

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: f95cc79 | Docs | Datadog PR Page | Give us feedback!}