chore(deps): patch js-yaml + postcss for 2 high Dependabot alerts (#8572)

js-yaml 5.2.1 -> 5.2.2 (GHSA-pm4m-ph32-ghv5, CWE-407: exponential parsing time in flow collections — a <200-byte payload hangs load()).
postcss 8.5.14 -> 8.5.23 (GHSA-r28c-9q8g-f849, CWE-22: path traversal via auto-loaded sourceMappingURL discloses arbitrary .map files).

Scoped override keeps promptfoo off its exact js-yaml@5.2.1 pin while holding
@apidevtools/json-schema-ref-parser on js-yaml ^4.2.0, so the nested override does
not major that subtree. Lockfile diff is exactly three versions (plus postcss's own
nanoid); nothing added or removed. check:lockfile passes.

Closes Dependabot #146 and #148.

package.json

@@ -265,7 +265,7 @@
     "ink-text-input": "^6.0.0",
     "ioredis": "^5.10.1",
     "jose": "^6.2.3",
-    "js-yaml": "^5.0.0",
+    "js-yaml": "^5.2.2",
     "jsonc-parser": "^3.3.1",
     "lowdb": "^7.0.1",
     "lucide-react": "^1.21.0",
@@ -394,7 +394,7 @@
     "dompurify": "^3.4.12",
     "fast-xml-parser": "^5.10.1",
     "sharp": "^0.35.0",
-    "postcss": "^8.5.14",
+    "postcss": "^8.5.18",
     "ip-address": "10.2.0",
     "qs": "^6.15.2",
     "uuid": "^14.0.0",
@@ -418,6 +418,12 @@
     "concurrently": {
       "shell-quote": "^1.9.0"
     },
-    "adm-zip": "^0.6.0"
+    "adm-zip": "^0.6.0",
+    "promptfoo": {
+      "js-yaml": "^5.2.2",
+      "@apidevtools/json-schema-ref-parser": {
+        "js-yaml": "^4.2.0"
+      }
+    }
   }
 }