fix(deps): bring macOS author to audited security parity

[Amir Bredy (ABMFST)]

Summary

Security parity port of #131 to mac-author-build. Merge after #131; do not cross-merge the active branches.

• Patch xmldom, Electron 42.x ZIP extraction, brace-expansion and nanoid with the same regression guards as the Full edition.
• Include the earlier Full-edition security updates that the author audit showed were still missing: js-yaml 4.3.2, sharp 0.35.4, Vitest 4.1.11, and patched Browserslist, fast-uri, Joi, selector-parser and browser-mapping dependencies.
• Preserve version 0.3.101-author.1, all author-only scripts and feature flags, and native optional targets for every supported platform.
• Update the author changelogs. No feature code or IPC contracts changed.

Validation

• Native GitHub-hosted macOS clean installation, dependency regression tests, core build and author-flavor build passed: https://github.com/Azure/ConfigForge/actions/runs/34941080920
• Full npm audit including development dependencies: 0 vulnerabilities.
• Verified public-registry resolutions and optional binary target preservation. No npm commands or installs ran locally.
• The temporary dependency-refresh workflow is removed from the final diff. All required PR checks passed on f9af064: full suite, lint, Node 22/24 builds, Electron smoke and CodeQL.

Flavor and release flow

• This is a selective dependency port, not a merge from main. Existing release metadata is unchanged and no release is published.
• Electron-maintained extraction replaces the vulnerable transitive installer package; no new direct application runtime dependency is introduced.

Merge status

Merged on 2026-09-17 after #131 using the maintainer-authorized, temporary account-specific review bypass. The original branch-protection settings were restored immediately; required CI and administrator enforcement stayed enabled. Merge commit: afd5d6f.