fix(deps): patch serialize-javascript vulnerability (GHSA-5c6j-r48x-rmvq) (#134)

## Summary

Fixes **GHSA-5c6j-r48x-rmvq** — a code injection vulnerability in
`serialize-javascript` ≤ 7.0.2.

## Details

`serialize-javascript@6.0.2` was a transitive dependency in the frontend
build via:
```
vite-plugin-pwa → workbox-build → @rollup/plugin-terser → serialize-javascript@6.0.2
```

Since `workbox-build@latest` still pins `@rollup/plugin-terser@^0.4.x`
(which uses `serialize-javascript@^6`), an npm override is used in
`src/frontend/package.json` to force the patched version.

**Updated:** `serialize-javascript` 6.0.2 → 7.0.4

## Verification

- ✅ Frontend build succeeds
- ✅ All 575 tests pass
- ✅ Resolves Scorecard code-scanning alert #32

## Risk

Low — `serialize-javascript` is only used at build time (Rollup/Terser
minification), not at runtime. The override forces a major version bump
(6→7) but the API is compatible for this use case.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: dorlugasigal

src/frontend/package-lock.json

@@ -28,6 +28,9 @@
     "sonner": "^2.0.3",
     "zustand": "^5.0.3"
   },
+  "overrides": {
+    "serialize-javascript": "^7.0.3"
+  },
   "devDependencies": {
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^16.3.0",