fix(deps): drain critical/high alerts, mocha 12; release 2.0.57

[robgilbreath]

Drains every open critical/high Dependabot alert in this repo and supersedes the three open Dependabot PRs.

Resolves

• Supersedes Bump serialize-javascript and mocha #14 (serialize-javascript 7.1.1 via mocha 12), Bump brace-expansion from 2.1.1 to 2.1.4 #11 (brace-expansion 2.1.4) and Bump js-yaml from 4.2.0 to 4.3.2 #10 (js-yaml 4.3.2) — all green individually, but they conflict in package-lock.json and are serialised by the up-to-date ruleset; this lands them in one merge with a package version bump so the result publishes.
• serialize-javascript 7.1.1: GHSA-5c6j-r48x-rmvq (mocha 10 pins ^6, so mocha moves 10.8.2 → 12.0.0, dev-only; the 4-test suite passes)
• brace-expansion (2.x dropped, 5.0.9): GHSA-3jxr-9vmj-r5cp
• js-yaml 5.4.1 (via mocha 12): GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj

How: npm install mocha@^12 --save-dev + npm update --package-lock-only (npm 12.0.2). Runtime deps move inside existing ranges: axios 1.20.0, form-data 4.0.6, fast-xml-parser 5.11.1.

Risk: low. Typecheck and tests pass locally. Version bumped to 2.0.57; merging publishes via OIDC.

Part of pncit/.github#7.