chore(deps): upgrade dependencies and retire redundant security overrides

Retire the machine-generated security-floor overrides in pnpm-workspace.yaml
that have become redundant now that the dependency graph satisfies those
floors naturally.

Direct deps bumped:
- lerna ^9.0.7 -> ^10.0.0 (pulls nx@23: axios 1.18.1, form-data 4.0.6,
  follow-redirects 1.16.0, yaml 2.9.0, brace-expansion 5.0.8, tmp 0.2.7,
  tar 7.5.20, js-yaml 4.3.0)
- send-backend axios ^1.15.2 -> ^1.18.0

Overrides removed (now satisfied naturally): @sigstore/verify, sigstore,
axios, brace-expansion, esbuild, follow-redirects, form-data, js-yaml,
protobufjs, tar, tmp, vite, ws.

Overrides kept (deep transitive, no upgradable direct parent):
@opentelemetry/core (@sentry/node@8), qs (express@4), uuid
(browserstack-node-sdk/google-gax), yaml (swagger-jsdoc pins 2.0.0-1).
Plus load-bearing browserstack-node-sdk>aws-sdk 2.1693.0 (ref #958) and a
tsx@4.23.1 pin (vite@8 optional peer) to satisfy the repo's minimumReleaseAge
supply-chain policy while keeping esbuild >=0.28.1.

pnpm audit: 41 -> 30 advisories, zero regressions (axios + nx advisories
cleared). Remaining advisories are pre-existing deep dev-tooling issues
outside this change's scope.

Written by an AI agent.

Refs #1064

Author: aaspinwall

package.json

@@ -19,7 +19,7 @@
     "@vitest/coverage-v8": "^4.1.5",
     "dotenv": "^16.6.1",
     "husky": "^9.1.7",
-    "lerna": "^9.0.7",
+    "lerna": "^10.0.0",
     "nodemon": "^3.1.14",
     "sort-package-json": "^2.15.1",
     "typescript": "^5.9.3",

packages/send/backend/package.json

@@ -52,7 +52,7 @@
     "@tweedegolf/sab-adapter-backblaze-b2": "^1.0.7",
     "@tweedegolf/sab-adapter-local": "^1.0.9",
     "@tweedegolf/storage-abstraction": "^2.2.1",
-    "axios": "^1.15.2",
+    "axios": "^1.18.0",
     "bcryptjs": "^3.0.3",
     "cookie-parser": "^1.4.7",
     "cors": "^2.8.6",