fix(deps): update js-yaml to patched releases

[Changyong Gong (chagong)]

Summary

Update only package-lock.json: root js-yaml 4.2.0 → 4.3.2 and TSLint's nested copy 3.14.2 → 3.15.2. Both releases satisfy existing cosmiconfig/webpack-cli/TSLint constraints. Preserve lockfile v3 and all 312 entries; only the two packages' version, resolved URL, and integrity fields change. No manifest, override, runtime, or unrelated dependency changes.

Alert coverage

Advisory	Open Dependabot alerts
GHSA-5p4m-2wfm-xmqj	98, 97
GHSA-52cp-r559-cp3m	87, 86
GHSA-h67p-54hq-rp68	84

Validation

• Node 22.15.1 / npm 10.9.2: npm ci --no-fund and npm run build passed. Build reports three Sass @import deprecation warnings and three bundle-size/performance warnings; no errors.
• npm ls js-yaml --all passed; all three parent dependency/peer ranges remain satisfied.
• Exact graph comparison confirms no added/removed package entries or unrelated metadata changes. Both locked instances are outside all five freshly fetched alert ranges.
• npm audit --package-lock-only --ignore-scripts --json: zero vulnerabilities, down from one affected package covering all five alerts. No audit-only exceptions remain; no alerts were dismissed or reopened. No dedicated lint or test npm script exists.
• Head CI is terminal: production build and E2E AutoTest succeeded; 55 successful checks, one aggregate-analysis job intentionally skipped for pull requests, and no external commit statuses.
• Initial E2E failure was an LLM false negative in macOS dependency viewer: the deterministic expand action passed and the screenshot shows the expanded caret/child, while the LLM downgraded it and then contradicted itself in its analysis. The same-main baseline passed. A rerun requested for that failed job passed without code, test-plan, or timeout changes.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wenyt (wenytang-ms)]

Lockfile-only js-yaml security update looks safe, and required CI including E2E AutoTest is green.