build(deps): bump js-yaml, qs, shell-quote (incorporate PR #1001)

[decyjphr]

Why

Dependabot PR #1001 (merge commit baac44d, npm_and_yarn group) bumped three packages to pick up security/patch fixes: js-yaml 4.1.1 -> 4.2.0, qs 6.15.0 -> 6.15.2, and shell-quote 1.8.3 -> 1.8.4. Those bumps had not yet landed on yadhav/fix-recent-issues (which has since moved to probot 14.3.2), so they still needed to be brought in.

Approach

Merging the Dependabot merge commit directly was not viable: baac44d drags in the entire pre-probot-14.3.2 divergent tree and conflicts across ~20 files that have nothing to do with the dependency bump. Instead, the three updates were applied surgically with npm update js-yaml qs shell-quote against the current probot 14.3.2 lockfile. npm resolved them to equal-or-newer semver-compatible versions that fully cover (and supersede) PR #1001:

• js-yaml 4.1.1 -> 4.3.1
• qs 6.15.0 -> 6.15.3
• shell-quote 1.8.3 -> 1.10.0

plus the related transitive bumps npm pulled in for consistency (js-yaml 3.14.2 -> 3.15.1, side-channel / side-channel-list). Only package-lock.json changed; js-yaml's ^4.1.0 range in package.json already permits 4.3.1, so no manifest change was needed.

Validation

• Unit + integration suite: 344 passing. The 7 suites that fail do so on a pre-existing probot-14.3.2 ESM-under-Jest loading issue (confirmed identical with and without this change), unrelated to the bump.
• lint:lockfile clean, npm ls clean.
• Full live smoke-test: 181 pass / 11 fail. All 11 failures are environmental (the harness gh PAT lacks admin:org scope for drift injection, and the ghas-compliance app is an enterprise installation without repo permissions). None stem from the dependency change.

Note for reviewers

Tests must be run under Node 22 (lint:engines and the probot 14.3.2 runtime require Node >= 22; Node 21 fails to load the now-ESM probot).