security: update vulnerable JavaScript dependencies (#3292)

## Summary

Updates the JavaScript lockfiles to remediate all 7 currently open
Dependabot alerts:

- `postcss` 8.5.15 → 8.5.18 (GHSA-r28c-9q8g-f849)
- `fast-uri` 3.1.3 → 3.1.4 (GHSA-v2hh-gcrm-f6hx / CVE-2026-16221)
- `@hono/node-server` 1.19.14 → 2.0.5 (GHSA-frvp-7c67-39w9)
- `brace-expansion` 1.1.14 / 2.1.0 / 5.0.5 → 1.1.16 / 2.1.2 / 5.0.7
(GHSA-3jxr-9vmj-r5cp / CVE-2026-13149)
- `sharp` 0.34.5 → 0.35.0 (GHSA-f88m-g3jw-g9cj)

Uses targeted pnpm overrides because these are transitive development
dependencies. No application code changes.

## Test plan

- [x] `pnpm install --frozen-lockfile` in `js/`
- [x] `pnpm run check:types` in `js/`
- [x] `pnpm run build` in `js/`
- [x] `pnpm install --force --frozen-lockfile` in
`js/internal/environment_tests/test-exports-cf/` after building the
linked SDK
- [x] `pnpm test` in `js/internal/environment_tests/test-exports-cf/`
(Wrangler dry-run)
- [x] Verified all affected lockfile resolutions meet the first patched
versions

Scoped to the seven open Dependabot alerts.

Co-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com>

Author: jkennedyvz

js/package.json

@@ -481,7 +481,17 @@
   },
   "pnpm": {
     "overrides": {
-      "js-yaml": "^4.1.1",
+      "@hono/node-server": "2.0.5",
+      "brace-expansion@<1.1.16": "1.1.16",
+      "brace-expansion@>=2.0.0 <2.1.2": "2.1.2",
+      "brace-expansion@>=3.0.0 <5.0.7": "5.0.7",
+      "fast-uri": "3.1.5",
+      "postcss": "8.5.23",
+      "js-yaml": "4.3.1",
+      "hono": "4.12.34",
+      "ip-address": "10.3.1",
+      "undici@>=7.0.0 <8.0.0": "7.29.0",
+      "undici@>=8.0.0 <9.0.0": "8.9.0",
       "vite": "^7.3.2",
       "form-data": "4.0.6",
       "langsmith": "0.6.0",