fix(deps): bump js-yaml and nanoid to patched versions

[soberm]

Summary

Resolves Dependabot alerts #262 (js-yaml) and #264 (nanoid, GHSA-2v37-7h3g-55p8).

js-yaml — scoped root resolution

Bumped the existing scoped resolution js-yaml: ^4.3.0 -> ^4.3.1, the minimal patched
version on the 4.x line. Scoped so no other major version line is forced to a breaking major.

nanoid — lockfile-only bump (no resolution)

nanoid was resolving to 3.3.16 transitively via postcss, which already requests
^3.3.16 — a range that permits the patched 3.3.18. So no resolutions entry is needed
or appropriate here: the fix is purely a lockfile re-resolution done with
corepack yarn up -R nanoid, bumping 3.3.16 -> 3.3.18 with zero package.json change.
Adding a resolution would be redundant pinning that hides future upstream patches.

Verification

• yarn install --immutable (CI's command) — exit 0
• yarn build — exit 0 (4/4 tasks successful)
• Diff limited to package.json (1 line, js-yaml) + yarn.lock (js-yaml + nanoid entries only), no unrelated churn
• Lockfile now has a single js-yaml@npm:^4.3.1 -> 4.3.1 and nanoid@npm:^3.3.16 -> 3.3.18

[changeset-bot]

⚠️ No Changeset found

Latest commit: e526ab3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR