fix: bump js-yaml to ^4.3.1 to resolve GHSA-5p4m-2wfm-xmqj

[0x74696D]

Summary

• js-yaml versions >=4.0.0 <4.3.1 are affected by GHSA-5p4m-2wfm-xmqj (CVSS 7.5).
• This package's declared js-yaml range (^4.1.1, set in 5.0.2) still permits npm/yarn resolving a vulnerable version for anything that installs this package as a dependency (including dd-trace) — a resolutions/overrides entry in a consumer's own package.json cannot fix this, since npm only honors those fields in the root project, not in transitively-installed packages. The only fix that protects downstream installs is tightening the range here.
• Tightens js-yaml to ^4.3.1 and bumps the package version to 5.0.3 so consumers resolve the patched version.

Context

Reported by a customer against dd-trace (Node.js tracer), which depends on this package. See related fix in dd-trace-js: DataDog/dd-trace-js#9768 (blocked on this release).

Test plan

• package.json / package-lock.json updated; verified the lockfile's js-yaml entry resolves to 4.3.1
• Diff kept minimal — no other dependency versions touched

[0x74696D]

Good catch — dropped the version bump from this PR. This now only changes the js-yaml dependency range (^4.1.1 → ^4.3.1) and the corresponding lockfile entry; package.json/package-lock.json version stays at 5.0.2. Bumping the version and cutting the actual release (which is tag-push-triggered per .github/workflows/release.yml) can happen as a separate step once this is merged.