build(deps): bump @graphql-codegen/plugin-helpers from ^5.0.4 to ^6.3.0

[Martyniuk]

What

Bumps @graphql-codegen/plugin-helpers from ^5.0.4 to ^6.3.0.

Fixes #213

Why

plugin-helpers 5.x depends on lodash: ~4.17.0, which resolves to versions affected by GHSA-r5fr-rjxr-66jc (high, _.template code injection) and GHSA-f23m-r3pf-42rh (moderate, prototype pollution). The tilde range can never reach a patched build — the fix only ships in lodash 4.18.x (public 4.17.23 exists but is not patched).

This repo already mitigates it locally via the lodash: '>=4.18.0' override in pnpm-workspace.yaml, but pnpm overrides don't propagate to consumers — anyone installing this package still inherits the vulnerable range. Bumping the declared dependency closes that gap.

Why ^6.3.0 and not ^6.0.0 or 7.x

• Security Vulnerability in indirect dependency lodash (via @graphql-codegen/plugin-helpers) #213 suggests ^6.0.0, but plugin-helpers 6.0.0–6.2.0 still declare lodash ~4.17.0 — lodash was dropped in 6.3.0, the final 6.x release.
• 7.x switches to the ESM-only change-case-all@^2.1.0, which this repo's jest 27 toolchain cannot load — with 7.1.0, 11 of 14 test suites fail (Jest encountered an unexpected token via resolve-external-module-and-fn.js). ^6.3.0 stays on the CJS-compatible line while allowing any future 6.x patch.
• API compatibility: this codebase imports exactly two symbols from plugin-helpers — oldVisit and resolveExternalModuleAndFn — both unchanged in 6.3.0.

Validation (node 24, pnpm 11.7.0, fresh install)

• pnpm install --frozen-lockfile: passes (lockfile in sync with the manifest)
• pnpm test: 14/14 suites, 125/125 tests, 116 snapshots pass
• pnpm build: clean
• pnpm why lodash --prod: empty — no lodash left in the published dependency chain

The remaining plugin-helpers@5.1.1 in the lockfile comes only from devDependencies (@graphql-codegen/typescript, @graphql-codegen/testing) and does not reach consumers; it stays covered by the existing workspace override.