chore(deps): update fast-uri security override

[corwinm]

Summary

• update the fast-uri pnpm override from 3.1.4 to 3.1.5
• expand the override selector to cover the advisory's full vulnerable range
• refresh only the corresponding pnpm-lock.yaml resolution

Security context

• Dependabot alert: https://github.com/corwinm/oil.code/security/dependabot/81
• Advisory: GHSA-7p8r-x3mc-p8w7 / CVE-2026-18446 (high severity)
• Vulnerable range: >=3.0.0 <3.1.5
• First patched version: 3.1.5
• Resolved path: @vscode/vsce > @secretlint/node > @secretlint/config-loader > ajv > fast-uri

The focused audit finding for fast-uri is resolved. pnpm audit still reports one unrelated pre-existing high-severity brace-expansion advisory (GHSA-rgw5-rvv9-x895), which is intentionally left out of this PR.

Verification

• pnpm install --frozen-lockfile
• pnpm why fast-uri --dev (all resolved paths use 3.1.5)
• pnpm audit --json (the fast-uri finding is gone; vulnerabilities reduced from 2 high to 1 unrelated high)
• pnpm test (26 passing)
• pnpm run verify:release
• pnpm exec vsce package --no-dependencies --out /tmp/oil-code-fast-uri-81.vsix