deps: bump mysql2 to 3.24.3 (GHSA-3f6p-5ww8-9rcr, GHSA-rgwj-5xj2-c3m3)

[katsugtgz]

Updates mysql2 to address GHSA-3f6p-5ww8-9rcr and GHSA-rgwj-5xj2-c3m3.

Evidence:

• package.json pinned mysql2@3.16.0
• OSV reports GHSA-3f6p-5ww8-9rcr (auth plugin downgrade to mysql_clear_password, fixed in 3.22.0) and GHSA-rgwj-5xj2-c3m3 (DoS with compress: true, fixed in 3.23.1) for 3.16.0
• updated version: 3.24.3

Validation:

• yarn install --ignore-scripts regenerates a consistent lockfile; OSV no longer reports either advisory for 3.24.3
• npx jest server/test/helpers/page.test.js passes. The cypress setup spec fails with cy is not defined on a plain jest run, both before and after this change, so it needs the cypress runner rather than jest
• npx eslint --ext .js,.vue . reports the same 122 pre-existing errors and 1 warning on master and on this branch, so the change adds no new lint issues

Scope: dependency/lockfile update only (package.json, yarn.lock).