fix(security): js-yaml 4.3.2, brace-expansion 1.1.18 in examples/js (INF-3002)

Clears all 4 open Dependabot alerts on the repo so INF-3002 can enable
Dependabot security updates here.

- js-yaml 4.2.0 -> 4.3.2 (GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj,
  GHSA-2883-xcg3-v3hh -- all high 7.5, quadratic/unbounded CPU consumption)
- brace-expansion 1.1.15 -> 1.1.18 (GHSA-3jxr-9vmj-r5cp, high 5.3, DoS via
  exponential-time expansion)

Three separate js-yaml advisories have fix floors 4.3.0, 4.3.1 and 4.3.2, so
the target is the highest of them, not the first. Both packages stay within
their existing major line: js-yaml 4.3.2 is the newest 4.x and brace-expansion
1.1.18 the newest 1.x, so no consumer crosses a major boundary.

Overrides changed from caret ranges to exact pins, per the skill's pin-style
rule -- the previous "^4.2.0" resolved to the vulnerable 4.2.0 despite fixes
being in range.

Verified: OSV reports 3 vulns on each old version and 0 on each new one;
npm audit clean; the regenerated lock adds and removes no node_modules
entries, only the 6 version/resolved/integrity lines.

INF-3002

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015PGXWenEJnUqbsVcZuwV5m

Author: andriy-sudo

examples/js/package-lock.json

@@ -26,11 +26,11 @@
   "overrides": {
     "ajv": "^6.14.0",
     "axios": "^1.18.1",
-    "brace-expansion": "^1.1.13",
+    "brace-expansion": "1.1.18",
     "flatted": "^3.4.2",
     "follow-redirects": "^1.16.0",
     "form-data": "^4.0.6",
-    "js-yaml": "^4.2.0",
+    "js-yaml": "4.3.2",
     "lodash": "^4.18.0",
     "minimatch": "^3.1.3"
   }