fix: resolve Dependabot alerts (#2634)

## Summary
- raise security overrides for the 18 open Dependabot alerts
- refresh the pnpm lockfile to patched dependency versions
- also resolve the newer `brace-expansion` advisory reported by `pnpm
audit`

## Verification
- `pnpm install --frozen-lockfile --ignore-scripts`
- `pnpm audit --prod --audit-level=low` — no known vulnerabilities
- `pnpm format:check`
- `git diff --check`

## Note
- `pnpm build` completed 10/15 tasks, then failed in the existing
`@langchain/langgraph-api` TypeScript build (`pnpm tsc --outDir dist`)
without diagnostics in the wrapper output.

Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>