fix(deps): apply compatible npm security updates

[vicancy]

Summary

• Update only lockfile dependencies that actually receive compatible security fixes; package.json is unchanged.
• Keep every changed package within its existing semver major and preserve public registry URLs.

Upgrades: Ajv 6.12.6 → 6.15.0 and 8.17.1 → 8.20.0; flatted 3.3.3 → 3.4.4; picomatch 2.3.1 → 2.3.2 and 4.0.3 → 4.0.5; uuid 11.1.0 → 11.1.1; immutable 5.1.4 → 5.1.9.

Remaining audit findings

• Bootstrap 3.4.1: GHSA-q58r-hwc8-rm9j and GHSA-vxmc-5x29-h64v require the excluded Bootstrap 5 migration in fix(deps): upgrade default template to Bootstrap 5.3.8 #11103.
• esbuild 0.27.3: GHSA-g7r4-m6w7-qqqr requires semver-breaking 0.28.1.
• Legacy immutable 3.8.2: 3.8.3 addresses GHSA-wf6x-7x77-mvgw but remains affected by GHSA-v56q-mh7h-f735 and GHSA-xvcm-6775-5m9r. Complete remediation requires immutable 4.3.9 or a breaking browser-sync dependency migration, so this PR leaves immutable 3.x exactly as main rather than taking a partial bump.

Validation

• npm audit --package-lock-only through the approved npm feed: only the excluded Bootstrap, esbuild, and legacy immutable groups above remain.
• Exact lockfile version diff confirms every changed package stays on its existing major; immutable 3.x matches main exactly.
• Template build, lint, and tests pass through the approved feed (with temporary mirror-lag overlays only for unrelated ws/postcss/nanoid versions).
• Release build passes with warnings as errors; 988 non-snapshot .NET 10 tests pass (12 skipped), and dotnet format --verify-no-changes passes.