#120 fix: update vulnerable dependency overrides

Summary

Update the lockfile and dependency-security guards for the actionable security fixes found during the October maintenance pass:

• devalue 5.9.2 -> 5.9.3, addressing Dependabot alerts #84, #85, #86, #87, #88, and #89.
• brace-expansion 1.1.18/2.1.4/5.0.9 -> patched versions, addressing Dependabot alerts #81, #82, and #83.
• sharp 0.35.4 -> 0.35.5 (GHSA-wq5f-xc86-pv6w).
• smol-toml 1.7.1 -> 1.9.1 (GHSA-r4xh-jqrq-34v2).
• source-map-js 1.2.1 -> 1.2.2 (GHSA-68fv-2mgg-jv7q).

Boundary tests and lockfile assertions are updated so these minimum versions remain enforced.

Verification

• npm ci --ignore-scripts
• npm run test:packages
• npm run test:integration (45 tests)
• npm run lint
• npm run typecheck
• npm run build
• npm run pack:dry-run
• DOCS_E2E_HOST=127.0.0.1 DOCS_E2E_PORT=4329 npm -w @form2js/docs run test:e2e -- --reporter=line (3 passed)

Full npm audit still reports the pre-existing @changesets/cli 2.x development-tool chain and the disputed http-cache-semantics advisory; those require separate policy/compatibility decisions and are intentionally not changed here.

Please review and merge manually if the required checks remain green. This PR is intentionally not configured for automatic merge.

---

Summary by cubic

Bumps several vulnerable transitive dependencies to patched versions and updates the dependency-security test so the new minimum versions stay enforced.

• devalue 5.9.2 → 5.9.3
• brace-expansion bumped across the 1.x, 2.x, and 5.x ranges
• sharp 0.35.4 → 0.35.5
• smol-toml 1.7.1 → 1.9.1
• source-map-js 1.2.1 → 1.2.2 (new override)
• Security test's semver comparison now handles prerelease identifiers, so patch-level boundaries with prereleases are classified correctly.

Known advisories for @changesets/cli 2.x and http-cache-semantics remain untouched pending separate compatibility decisions.