build(docs): override vulnerable transitive npm packages of the site

[indigo423]

What changed

Six Dependabot alerts on website/package-lock.json, all transitive dependencies of @docusaurus/core 3.10.2 (which still pins tinypool ^1.0.2), are fixed by pinning the patched versions through the existing npm overrides block: tinypool 2.2.0, shell-quote 1.12.0, postcss-selector-parser 7.1.6, http-cache-semantics 4.3.0, source-map-js 1.2.2. Same mechanism as the existing serialize-javascript, uuid and encoding-sniffer overrides.

Not fixed: braces (GHSA-vfj7-8cjw-p6xm, regex stack exhaustion). The advisory covers every published version, including the latest 3.0.3, so no override helps. It is a dev-only glob helper used at build time.

Supersedes #159, which bumped only shell-quote in the lockfile; Dependabot closes it once this merges.

How it was verified

• npm audit: the only remaining root advisory is braces; the 28 listed entries are its dependents.
• make docs-urls passes with the overrides (full site build plus link check).
• Resolved versions checked in the lockfile: shell-quote 1.12.0, tinypool 2.2.0, http-cache-semantics 4.3.0, postcss-selector-parser 7.1.6, source-map-js 1.2.2.

Checklist

• make verify passes locally (Rust tree untouched; CI runs it).
• Commits follow Conventional Commits and are signed off; AI-assisted commits carry an Assisted-by: trailer.
• New source files carry the SPDX header. (none)
• Docs updated. (not applicable)
• New dependencies are license-compatible. (no new packages; make licenses covers the Rust tree only)
• Breaking changes called out. (none)

🤖 Generated with Claude Code