fix: update js-yaml security patch

[corwinm]

Summary

• Remediates Dependabot alert #82, GHSA-5p4m-2wfm-xmqj.
• Updates the existing scoped js-yaml override from 4.3.0 to 4.3.1 and expands its vulnerable-range selector to <4.3.1.
• The vulnerable path is development tooling through @vscode/test-cli → mocha → js-yaml.

Dependency change

• js-yaml: 4.3.0 → 4.3.1.
• Lockfile churn is limited to the override, package resolution/integrity, and affected consumer edges.

Verification

• pnpm install --frozen-lockfile
• pnpm why js-yaml — all resolved paths use 4.3.1.
• pnpm run check-types
• pnpm run lint
• pnpm run compile
• pnpm exec vsce package --no-dependencies --out /tmp/oil-code-js-yaml-security.vsix — produced a non-empty 130092-byte VSIX.
• pnpm audit --json — the js-yaml advisory is resolved; one unrelated pre-existing brace-expansion high advisory remains and is outside this focused PR.