chore(deps): bump vulnerable npm deps to clear Dependabot alerts

[StefanSteiner]

Summary

Clears the open npm Dependabot security alerts on tableau/hyper-api-rust by
bumping the flagged packages in the two Node lockfiles. Lockfile-only — no
package.json manifests changed and node_modules is gitignored.

The Apache Thrift Rust alert
(alert 16,
Cargo.lock → 0.23.0) is intentionally not included: as in the past, the
patched version can't yet be adopted without breaking other dependencies.

Dependabot alerts addressed

Each of the following should auto-resolve once this merges to main and
Dependabot re-scans the lockfiles (Dependabot alerts close automatically when
the vulnerable version is gone — they are not closed via PR keywords):

Alert	Severity	Package	Lockfile	Fix
19	high	js-yaml	hyperdb-api-node/	4.2.0 → 4.3.1
18	medium	postcss	hyperdb-api-node/examples/hyper-explorer/	8.5.15 → 8.5.26
17	high	postcss	hyperdb-api-node/examples/hyper-explorer/	8.5.15 → 8.5.26
15	high	js-yaml	hyperdb-api-node/	4.2.0 → 4.3.1
14	low	body-parser	hyperdb-api-node/examples/hyper-explorer/	1.20.5 → 1.20.6
13	high	shell-quote	hyperdb-api-node/examples/hyper-explorer/	1.8.4 → 1.10.0

All six alerts (four distinct packages) are patched to versions at or above the
Dependabot-recommended fix.

Notes

• Bumping postcss pulled its transitive nanoid from 3.3.12 → 3.3.17. npm audit separately flags nanoid <3.3.18 (GHSA-2v37-7h3g-55p8), but nanoid is
  not a Dependabot alert on this repo and 3.3.18 is a very recent release; it
  will be picked up on a future resolve. Left out of scope here.
• The hyper-explorer lockfile's embedded ../.. descriptor also re-synced the
  parent hyperdb-api-node devDependency version ranges to match its current
  package.json — a metadata sync, not an installed-package change.

Verification

• npm audit in hyperdb-api-node/ → 0 vulnerabilities.
• npm audit in hyperdb-api-node/examples/hyper-explorer/ → only the
  out-of-scope nanoid <3.3.18 finding remains; all four alerted packages clear.
• No Rust/Cargo changes; workspace build/tests unaffected.