chore(deps): switch to surgical overrides (Ravneet review)

Replaces the `npm audit fix` cascade approach with targeted npm
overrides so only the two SLA-tracked CVE packages move.

Per Ravneet's [Medium] finding on PR #1183 / #1185: the `npm audit fix`
run cascaded to 27 packages including axios 1.16.1 → 1.20.0 (a *direct*
dep and minor bump on the HTTP client used against BrowserStack APIs)
plus form-data 4.0.5 → 4.0.6, @babel/*, browserslist, ws, qs, semver,
glob, etc. For a security PR framed as "just js-yaml + brace-expansion",
dragging a minor axios bump in expanded the risk surface for a CLI that
ships to customer CI machines.

This commit resets `package-lock.json` to master's baseline and adds
per-major overrides in `package.json`:

  "js-yaml@3": "3.15.2"       (GHSA-52cp-r559-cp3m)
  "js-yaml@4": "4.3.2"        (GHSA-52cp-r559-cp3m)
  "brace-expansion@1": "1.1.18" (GHSA-3jxr-9vmj-r5cp)
  "brace-expansion@2": "2.1.4"  (GHSA-3jxr-9vmj-r5cp)

Verified via `npm install --package-lock-only`:
  - js-yaml:        4.1.1 → 4.3.2,  3.14.2 → 3.15.2
  - brace-expansion: 1.1.14 → 1.1.18, 2.1.0 → 2.1.4
  - axios:           1.16.1 (unchanged)
  - form-data:       4.0.5 (unchanged)

`package-lock.json` diff shrinks from 262 lines to 42; both target
CVEs are absent from `npm audit`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jasbir-browserstack