Fix UI dependency vulnerabilities

[fmassot]

Summary

• upgrade vulnerable Quickwit UI dependencies and regenerate yarn.lock
• move React Router to 8.3.0 and Vite to 8.1.5, with the TypeScript and Jest configuration needed for their ESM packaging
• add targeted Yarn resolutions for vulnerable transitive dependencies whose parents have not widened their supported ranges yet
• update Monaco type-only imports for modern package exports

Why

Dependabot reports security vulnerabilities in the UI dependency graph. The previous lockfile produced 152 vulnerable dependency paths in yarn audit, including high-severity findings in React Router, brace-expansion, Axios, DOMPurify, Vite/esbuild, PostCSS, JS-YAML, and WebSocket dependencies.

Some newly disclosed fixes are available only on newer major lines. In particular, Jest still requests older test-exclude and glob ranges that resolve to vulnerable brace-expansion releases, so the lockfile uses validated security resolutions until upstream ranges catch up.

Impact

No application behavior is intended to change. The UI now builds with Vite 8/Rolldown and uses current ESM package resolution. Yarn prints expected range warnings for the test-exclude, glob, and DOMPurify security resolutions; the frozen install and UI checks validate those overrides.

Validation

• yarn --cwd quickwit/quickwit-ui install --frozen-lockfile
• yarn --cwd quickwit/quickwit-ui audit — 0 vulnerabilities
• yarn lint
• yarn type
• yarn test --runInBand — 7/7 suites passed
• yarn build