deps: resolve newly-expanded Dependabot security advisories

[laileni-aws]

Problem

After the earlier security PRs (#136/#137/#138) merged, several Dependabot
alerts re-surfaced because their advisories were expanded to new version
lines (or newly published) — re-flagging packages at versions the earlier PRs
didn't target. Example: the uuid advisory added < 11.1.1; yaml added
< 1.10.3; a new koa CVE needs 2.16.4.

Solution

Resolve the 10 cleanly-fixable alerts with the same safe overrides approach,
verified against the current advisory ranges. Root lockfile only; verified
idempotent.

Alert(s)	Package	Fix	Notes
#99, #246	koa	2.16.2 → 2.16.4	new CVE
#214	@tootallnate/once	→ 2.0.1
#170, #20	brace-expansion (1.x)	→ 1.1.13	version-scoped (@1)
#157	yaml	→ 1.10.3	expanded to 1.x line
#131	immutable	→ 4.3.8	expanded to 4.x line
#106	minimatch (5.x)	→ 5.1.8	version-scoped (@5)
#55	diff	4.x→4.0.4, 5.x→5.2.2	version-scoped
#36	glob (10.x)	→ 10.5.0	version-scoped (@10)

Version-scoped overrides (pkg@major) are used where multiple major lines
coexist, so unaffected lines aren't disturbed.

Deferred: uuid (#217, #219, #220)

Not included — these need a major uuid 9 → 11 bump, which is genuinely
risky here:

• uuid is a direct dependency of the generated src.gen clients (^9.0.1),
  and npm ignores an override on a direct dependency unless the spec matches
  exactly (so it stays 9.0.1).
• In root, npm won't dedupe the hoisted uuid@9.0.1 shared across older
  @aws-sdk clients via @smithy/middleware-retry (verified with
  --package-lock-only, a real reify, and npm dedupe).
• A proper fix also touches the generated clients + @types/uuid and needs
  build validation. Left for a dedicated follow-up.

Verification

• All 10 alerts confirmed RESOLVED by cross-checking installed versions
  against the current (expanded) advisory ranges.
• Root package-lock.json verified idempotent.

Draft: opened as a draft for CI validation.

---

• Treat all work as PUBLIC. Private feature/x branches will not be squash-merged at release time.
• Your code changes must meet the guidelines in CONTRIBUTING.md.
• License: I confirm that my contribution is made under the terms of the Apache 2.0 license.