fix(security): update picomatch override to >=4.0.4

[fro-bot]

Summary

Addresses CVE-2026-33671 (HIGH) and CVE-2026-33672 (MEDIUM) - picomatch package vulnerabilities.

Security Advisories

CVE-2026-33671 (HIGH)

• Vulnerability: ReDoS via extglob quantifiers
• Severity: High
• Affected versions: >= 4.0.0, < 4.0.4

CVE-2026-33672 (MEDIUM)

• Vulnerability: Method Injection in POSIX Character Classes causes incorrect Glob Matching
• Severity: Medium
• Affected versions: >= 4.0.0, < 4.0.4

Changes

• Added `picomatch: >=4.0.4` to pnpm overrides in package.json

Dependency Chain

`picomatch` is a transitive dependency via multiple paths:

• `@bfra.me/eslint-config` → `@stylistic/eslint-plugin` → `picomatch`
• `@bfra.me/eslint-config` → `typescript-eslint` → `tinyglobby` → `fdir` → `picomatch`
• Multiple other ESLint plugin paths

Testing

• `pnpm check-format` passes
• `pnpm check-types` passes
• `pnpm lint` passes