fix(deps): resolve open Dependabot alerts

[drewstone]

Summary

Completes the interrupted Dependabot remediation for SOC 2 Vanta Request 7. All 14 fixable alerts are resolved via resolutions in package.json (minimal version bumps, regenerated yarn.lock); 3 alerts have no patched version upstream and are left open (documented below).

Alerts addressed (14)

Alert	Package	Severity	From	To
#371	postcss-selector-parser	low	6.1.2	6.1.4
#370	decode-uri-component	moderate	0.2.2	0.5.0
#361, #360, #359	undici	moderate	5.29.0	6.28.0
#325, #324, #323	undici	low/moderate	5.29.0	6.28.0
#301	qs	moderate	6.15.1	6.15.3
#300	serialize-javascript	moderate	7.0.3	7.0.7
#299	uuid	moderate	8.3.2/3.4.0/9.0.1 (mixed)	11.1.1
#254, #253	undici	moderate	5.29.0	6.28.0
#87	tough-cookie	moderate	2.5.0	4.1.4

(undici and uuid each cover multiple alert numbers for the same package/vulnerability family.)

Alerts left open (3) — no patched version available

Alert	Package	Severity	Reason
#78	request	moderate	Deprecated package, no fix released. Deep transitive dependency of circomlibjs → web3 → web3-bzz → swarm-js → eth-lib → servify. circomlibjs is actively used for Poseidon hashing/merkle-tree utilities across packages/utils, packages/anchors, and contract tests — not safely removable.
#183	web3-core-subscriptions	low	No fix released. Same circomlibjs → web3 transitive chain (web3-eth, web3-shh, web3-core).
#198	elliptic	low	No fix released. Transitive dependency of ethers' @ethersproject/signing-key (used throughout the codebase) and of the circomlibjs/web3/eth-lib chain.

Also fixed

The interrupted WIP commit had accidentally bumped the solidity-fixtures git submodule pointer to a newer upstream commit as a side effect of git submodule update --init --recursive (submodule tracks main, no pin). That's unrelated to Dependabot remediation; reverted it back to the commit pinned on main.

Gates run

NODE_OPTIONS=--no-network-family-autoselection yarn install --production=false
# success Already up-to-date. (lockfile was already consistent with package.json)

yarn compile   # lerna run compile --scope=@webb-tools/contracts
# Compiled 92 Solidity files successfully (evm target: paris).

yarn build:packages   # lerna run build (9 packages)
# Successfully ran target build for 9 projects

yarn ts-check   # tsc --noEmit -p ./tsconfig.json
# Done in 2.70s, no errors

cd packages/contracts && forge build
# Compiler run successful with warnings (pre-existing lint notes only)

cd packages/contracts && forge test
# 79 passed, 1 failed (see below), 0 skipped — 80 total

npx hardhat test representative subset (full ZK-proof suite is multi-minute per file; ran the files that exercise the bumped deps most directly — ethers signing, circomlibjs/Poseidon, ganache/web3 deployment path):

npx hardhat test test/governance/governable.test.ts test/token/FungibleTokenWrapper.test.ts test/trees/MerkleTreePoseidon.test.ts test/create2/create2.test.ts
# 22 passing (4s)

Pre-existing flaky fuzz test (not caused by this change)

forge test failed once on VAnchorHandlerTest.test_anchorUpdateShouldFailIfOverwritingEdgeIncorrectly (arithmetic underflow/overflow panic near an address fuzz input close to type(uint160).max). This branch makes zero changes under packages/contracts (verified with git diff origin/main...HEAD --stat -- packages/contracts, empty). Reproduced the same failure directly on origin/main in a clean worktree (2 of 5 fresh-cache runs failed with the same panic, different fuzz seed each time) — confirmed pre-existing, seed-dependent flake in the test/contract logic, unrelated to these dependency bumps. Left untouched per "never weaken tests."

DO NOT MERGE — for review only.