LTS-4979/LTS-5093: bump fast-uri and js-yaml overrides to patched floors

fast-uri: 3.1.5 -> ^3.1.6 (was itself already inside the vulnerable range
for GHSA-5jgf-p345-68v8 - host confusion via skipped IDN canonicalization
on scheme-relative references; also clears GHSA-f65p-4m7j-42xc and
GHSA-fph4-wmhf-6fwf, both patched at 3.1.6). Switched from an exact pin to
a caret range so this override doesn't age into the next vulnerable
version the way 3.1.5 (an exact pin from PR #19/#20) did.

js-yaml: two installed majors, both one patch behind the real floor for
GHSA-2883-xcg3-v3hh (maxTotalMergeKeys doesn't count empty merge-source
mappings, so CPU use is unbounded despite the limit):
  js-yaml@3: 3.15.1 -> ^3.15.2
  js-yaml@4: 4.3.1  -> ^4.3.2
Kept the version-scoped override keys (js-yaml-cloudformation-schema pulls
a separate 3.x copy via @kubernetes/client-node's dependents) so the 3.x
consumer isn't forced onto 4.x.

Verified against the real installed tree, not just the lockfile:
`npm ci` clean install + `npm ls js-yaml --all` / `npm ls fast-uri --all`
confirm js-yaml@3.15.2 + js-yaml@4.3.2 (was 3.15.1/4.3.1) and
fast-uri@3.1.8 (was 3.1.5, resolved by the caret range). `npm audit --json`
no longer lists js-yaml or fast-uri. Both target versions clear this
repo's .npmrc min-release-age=7 cooldown (published 2026-08-23/26,
comfortably >7 days before today).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: MihirR-BS

package-lock.json

@@ -17,9 +17,9 @@
     "jws": "4.0.1",
     "tar-fs": "3.1.1",
     "basic-ftp": "^5.3.1",
-    "fast-uri": "3.1.5",
-    "js-yaml@3": "3.15.1",
-    "js-yaml@4": "4.3.1",
+    "fast-uri": "^3.1.6",
+    "js-yaml@3": "^3.15.2",
+    "js-yaml@4": "^4.3.2",
     "brace-expansion": "2.1.4",
     "socks": "2.8.9",
     "ip-address": "10.4.0",