chore: resolve all medium+ severity dependency security alerts

[christianmat]

Summary

Resolves all open Dependabot alerts of medium severity and above (1 critical, 47 high, 41 medium at time of writing). After these changes, yarn npm audit --all --severity moderate reports no remaining CVEs (only two deprecation notices for @storybook/testing-library in the deprecated reactv1 package and eslint 8 EOL in smithy, which are not security advisories).

Direct dependency bumps:

• uuid 9 → 11 in @frigade/js and @frigade/reactv1 (only v4() is used; API unchanged) — includes a patch changeset for @frigade/js
• vite 4 → 6.4.3 and Storybook packages 8.5.3 → 8.6.17 in the smithy Storybook app (vite 4/5 lines are unpatched for GHSA alerts up to <= 6.4.2)
• turbo 1 → 2.9.14, with the required turbo.json migration (pipeline → tasks)

Transitive fixes: re-resolved within-range packages via yarn up -R (tar, minimatch, axios, ws, js-yaml, lodash, dompurify, postcss, glob, storybook 7.x line, qs, joi, yaml, picomatch, form-data, brace-expansion, flatted, defu, tmp, babel packages), plus root resolutions for patches outside dependents' ranges:

• tar → ^7.5.21 (critical; dependents cacache/node-gyp/giget pin ^6, which has no patched release)
• uuid → ^11.1.1, serialize-javascript → ^7.0.5, ip-address → ^10.1.1
• express/path-to-regexp → 0.1.13 (express pins an exact vulnerable version)
• minimatch@9.0.3 → 9.0.7 (pinned exactly by typescript-estree)

Test plan

• yarn build (turbo 2): all 3 packages build
• js-api integration suite: 23/23 pass
• @frigade/react unit tests: 17/17 pass
• smithy build-storybook production build succeeds on vite 6 + Storybook 8.6
• yarn npm audit --all --severity moderate: no CVEs remaining

Made with Cursor