Deps: override transitive advisories to their fixed releases

[vvillait88]

Summary

Clears advisories published today against transitive development dependencies (GHSA-68fv-2mgg-jv7q for source-map-js, GHSA-r4xh-jqrq-34v2 for smol-toml, and GHSA-jqcg-44mw-7w3h for proxy-addr where the tree carries it) by overriding each to its fixed release. Overrides apply to this repository's own install only, so the published package and what consumers install are unchanged, and no release is needed.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

No change.

Test plan

bun install, then osv-scanner scan source --lockfile=bun.lock reports no issues (it reported these advisories before the change), and bun run typecheck, bun run lint and bun run test pass.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests