chore(deps): apply dependabot lockfile bumps (#308, #318)

Reconcile the two open dependabot dep-bumps into one consistent lockfile:
- protobufjs ^8.6.3 -> ^8.6.6 and brace-expansion -> 5.0.8 (#318)
- js-yaml 4.3.0 and other transitive dev-dep bumps (#308)

Lockfile-only; package.json protobufjs bump came in via the #318
cherry-pick. Regenerated with npm to keep the tree internally consistent.

Author: rudyberends