Fix Dependabot alert #18: upgrade js-yaml to 4.2.0 via override

Add npm override for js-yaml ^4.2.0 to resolve CVE-2026-53550, a
quadratic-complexity DoS vulnerability in merge key handling.
The vulnerable js-yaml <=4.1.1 was a transitive dev dependency via
@istanbuljs/load-nyc-config.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: tidy-dev

package-lock.json

@@ -28,7 +28,8 @@
   },
   "overrides": {
     "undici": "^6.24.1",
-    "handlebars": "^4.7.9"
+    "handlebars": "^4.7.9",
+    "js-yaml": "^4.2.0"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",