fix(deps): override js-yaml to 4.3.2 to address Dependabot alerts #14-#18

[johnnylemonny]

A bunch of Dependabot js-yaml alerts appeared after my last merge!

Summary

Addresses Dependabot security alerts #14, #15, #16, #17, and #18 on nyaomaru/changelog-bot by updating the js-yaml override in pnpm-workspace.yaml and pnpm-lock.yaml from 4.1.0 to 4.3.2.

Vulnerabilities Addressed

• Alert chore(docs): update documents #14 (GHSA-mh29-5h37-fv8m / CVE-2025-64718): Prototype pollution in merge (<<) (vulnerable >= 4.0.0, < 4.1.1, patched in 4.1.1).
• Alert fix: PR title setting #15 (GHSA-h67p-54hq-rp68 / CVE-2026-53550): Quadratic-complexity DoS in merge key handling via repeated aliases (vulnerable >= 4.0.0, <= 4.1.1, patched in 4.2.0).
• Alert Release: 0.0.3 #16 (GHSA-52cp-r559-cp3m): YAML merge-key chains can force quadratic CPU consumption (vulnerable >= 4.0.0, < 4.3.0, patched in 4.3.0).
• Alert docs(changelog): v0.0.3 #17 (GHSA-5p4m-2wfm-xmqj): Quadratic CPU consumption in !!omap resolution (vulnerable >= 4.0.0, < 4.3.1, patched in 4.3.1).
• Alert feat(changelog): add LLM pre-processing and post-tuning to improve classification #18 (GHSA-2883-xcg3-v3hh): maxTotalMergeKeys does not limit CPU use for empty merge sources (vulnerable >= 4.0.0, < 4.3.2, patched in 4.3.2).

Changes

• Pinned js-yaml: 4.3.2 in pnpm-workspace.yaml overrides.
• Updated pnpm-lock.yaml minimally via pnpm install without formatting changes.

Verification

• pnpm run lint passed (0 errors, 0 warnings).
• pnpm test passed (71 test suites, 393 tests).
• pnpm run build & pnpm run check:dist passed.
• CLI dry run verified successfully.
• No remaining vulnerabilities for js-yaml in GitHub Advisories (gh api "advisories?affects=js-yaml@4.3.2" returns []).

[nyaomaru]

LGTM! 🚀