chore: consolidate Dependabot dependency updates

Safe patch/minor bumps consolidated from open Dependabot PRs:
- lodash 4.17.21 → 4.17.23 (closes #256)
- js-yaml 4.1.0 → 4.1.1 (closes #249) - transitive dep, lockfile update
- qs 6.13.0 → 6.14.1 (closes #255) - transitive dep, lockfile update
- @isaacs/brace-expansion 5.0.0 → 5.0.1 (closes #258) - transitive dep, lockfile update

Note: #245 (style-dictionary 4→5 + sd-transforms 1.2.3→1.3.0) excluded;
v5 is a breaking major version requiring dedicated build config migration.

Author: mhewson

package.json

@@ -74,7 +74,7 @@
     "glob": "^13.0.0",
     "husky": "^9.1.7",
     "lint-staged": "^16.2.7",
-    "lodash": "^4.17.21",
+    "lodash": "^4.17.23",
     "npm-publish-prerelease": "^1.0.2",
     "oxfmt": "^0.36.0",
     "oxlint": "^1.51.0",