Update dependencies to resolve Dependabot alerts (#2128)

* Update dependencies to resolve Dependabot alerts

# If applied, this commit will
update the Composer, theme Yarn and Cypress Yarn lock files to the
latest versions allowed by the current version constraints.

# Why is this change needed?
Prior to this change, many Dependabot PRs and security alerts were
open (twig, simplesamlphp/saml2, league/flysystem, js-yaml, svgo,
fast-uri, postcss, brace-expansion and more).

# How does it address the issue?
This change runs a constraint-respecting update of all three lock
files. Major version bumps (phpunit 13, doctrine-bundle 3, symfony 8,
js-yaml 5, webpack-cli 7, babel-loader 10) are left out. The newer
stylelint flags valid SCSS @mixin preludes, so at-rule-prelude-no-invalid
is disabled in the same way media-query-no-invalid already is.

The guzzlehttp/guzzle and guzzlehttp/psr7 fixes remain blocked by the
~2.8.0 psr7 pin in simplesamlphp/assert 1.9.1. This is documented in the
CHANGELOG. extract-zip and braces have no patched release yet.

# Provide links to any relevant tickets, articles or other resources
Refs #2121

* Trim dependency update changelog entry

# If applied, this commit will
remove the notes about what was not updated from the CHANGELOG entry.

# Why is this change needed?
Prior to this change, the entry described the major bumps and the
guzzle/psr7 blocker that were not part of this change. A changelog
should only list what was done.

# How does it address the issue?
This change keeps a single line describing the dependency update.

# Provide links to any relevant tickets, articles or other resources
Refs #2121

* Narrow stylelint at-rule-prelude exception to SCSS syntax

# If applied, this commit will
keep at-rule-prelude-no-invalid enabled and only skip the SCSS
at-rules and the interpolated @media queries in breakpoints.scss.

# Why is this change needed?
Prior to this change, the rule was disabled for the whole theme to get
past false positives on SCSS mixin signatures and interpolation, which
would also hide real mistakes in at-rule preludes.

# How does it address the issue?
This change passes the SCSS-only at-rules (mixin, include, if, each,
for, function, return, use, else) through ignoreAtRules, and disables
the rule for breakpoints.scss only, where @media uses #{$var}
interpolation.

# Provide links to any relevant tickets, articles or other resources
Refs #2121

Author: kayjoosten

CHANGELOG.md

@@ -13,6 +13,10 @@ on the EngineBlock wiki.
 
 ## Unreleased
 
+Updated:
+
+* Updated Composer and Yarn (theme and Cypress) dependencies within their current version constraints to resolve open Dependabot alerts. (#2121)
+
 Removed:
 
 * Removed the guest_qualifier / isMemberOf guest-status feature (`AddGuestStatus`). Unused and confirmed safe to remove. `FilterReservedMemberOfValues` is kept, as it also guards against IdPs spoofing reserved `urn:collab:org` group memberships. (#1294)