chore(deps): minimatch vulnerability

[KeylaMunnoz]

Resolves Dependabot ReDoS alerts for minimatch affecting older package versions:

#67: repeated wildcards with non-matching literal.
#70, #73, and #75: matchOne() with combinatorial backtracking due to multiple GLOBSTAR segments.
#74: nested *() extglobs generating catastrophic backtracking in regex.

Changes

• yarn up -R minimatch: bumps minimatch within compatible ranges of each dependent, without major bumps. Versions are now at 3.1.5, 8.0.7, 9.0.9, and 10.2.6.
• eslint-plugin-sonarjs pinned to 3.0.7: stays on v3 and already upgrades minimatch from 9.0.5 to 10.1.2.
• resolution for eslint-plugin-sonarjs/minimatch to ^10.2.3: sonarjs@3.0.7 pins minimatch exactly to 10.1.2, which remains vulnerable (<10.2.3). The resolution forces the patched version strictly for this package (resolves to 10.2.6).

Why not eslint-plugin-sonarjs@4?
Tested on a temporary branch. v4.2.2 introduces 22 new lint errors:

• 11 sonarjs/argument-type.
• 11 sonarjs/null-dereference.
  These errors are present in core, dom, and their test files. Migration to v4 can be evaluated in a separate PR.

[rojasTob]

Thanks Key! The resolved versions (3.1.5 / 8.0.7 / 9.0.9 / 10.2.6) cover all the patched ranges for #67, #70, #73, #74 and #75, the scoped resolution correctly moves sonarjs onto 10.2.6, and CI lint passes with it.

Two non-blocking follow-ups:

• Could we add a short note or open an issue so the eslint-plugin-sonarjs/minimatch resolution gets removed when we migrate to sonarjs v4?
• brace-expansion still has its own open alerts (#133, #141, #169–#171, #177, #178). The versions currently in the lockfile (1.1.11, 2.0.1, 2.1.4 and 5.0.9) are all still affected, so that's worth a separate PR.