chore: resolve form-data, ws, tmp CVEs via overrides

[EightRice]

Summary

Pins three transitive dependencies to patched versions via npm overrides, addressing Dependabot alerts:

• form-data — CRLF injection via unescaped multipart field/file names, GHSA-hmw2-7cc7-3qxx (high). Vulnerable: 4.0.0 (via axios, hardhat-deploy) and 2.5.1 (via then-request). Patched: ^4.0.6.
• ws — memory exhaustion DoS from tiny fragments/data chunks, GHSA-96hv-2xvq-fx4p (high, CVE-2026-48779 range). Vulnerable: 8.17.1 (via ethers), 7.4.6 (via @ethersproject/providers), 7.5.10 (via hardhat). Patched: ^8.21.1.
• tmp — path traversal via unsanitized prefix/postfix, GHSA-ph9p-34f9-6g65 (high). Vulnerable: 0.0.33 (via solc, exact-pinned). Patched: ^0.2.6.

No direct dependencies were upgraded; all three are transitive deps pinned/ranged below the patched versions by their parents, so overrides was needed to force resolution.

Test plan

• npm install — resolves cleanly, lockfile confirms form-data@4.0.6, ws@8.21.1, tmp@0.2.7 (all single deduped instances now)
• npm audit — form-data, ws, tmp no longer appear in the vulnerability report
• npx hardhat compile — compiles all 62 Solidity files successfully
• npx hardhat test — 0 passing / 9 failing, but failures are pre-existing and unrelated: all 9 are in the default Hardhat boilerplate test/Lock.js, which references a Lock contract that doesn't exist in this repo's contracts/ directory (HH700: Artifact for contract "Lock" not found"). This file predates this change and was never adapted to the actual contract set.