build(deps): patch xmldom fragment injection

[GSTJ]

Summary

Updates the vulnerable XML parser dependencies to patched releases, closing Dependabot alerts #55 and #56.

Details

• Pins the @expo/plist path to 0.8.15 and the plist path to 0.9.12.
• Keeps each dependency on its existing major version.

Testing steps

pnpm install --frozen-lockfile
pnpm run test
pnpm audit --audit-level moderate

Confirm the suite passes and the audit exits 0 with only the two ignored high-severity findings.

[GSTJ]

Local verification from 6b4a414: 72 tests passed, the moderate-level audit exited 0, and the dependency graph contains only the patched 0.8.15 and 0.9.12 releases.