fix(security): clear dependency and ReDoS alerts

[diegosouzapw]

Summary

• replace the backtracking PEM and assignment secret scans with bounded, linear scans
• replace trailing-whitespace regexes in history and fact-sheet paths with trimEnd()
• move pnpm overrides to the workspace configuration and pin all advisory-fixed transitives

Validation

• pnpm audit --json: 0 vulnerabilities
• pnpm install --frozen-lockfile
• pnpm run lint
• pnpm run typecheck
• pnpm run build
• pnpm test: 1,157 passed

[sonarqubecloud]

❌ The last analysis has failed.

See analysis details on SonarQube Cloud