fix(server): clear Trivy npm dependency vulnerabilities

What changed

Bumped the pinned pnpm.overrides in server/package.json (and added overrides for the transitive form-data and @opentelemetry/core) to the fixed versions, regenerating server/pnpm-lock.yaml:

Why

The trivy fs scan in server/mise/tasks/security.sh runs with no severity filter and no --ignore-unfixed:

trivy fs --exit-code 1 --skip-files "mix.exs,mix.lock" --skip-dirs "priv/static,node_modules,deps,_build" ./

so it fails on every known CVE in server/pnpm-lock.yaml, regardless of severity or whether the project actually exercises the vulnerable path. Trivy refreshes its vulnerability DB on each CI run, so a batch of recently disclosed npm advisories started failing the Security job on main (12 findings) without any related code change. This is independent of the PR that surfaced it (#11298); the failure reproduces on main.

Why these versions / this approach

The repo already pins security-sensitive transitive packages through pnpm.overrides (axios, ajv, dompurify, protobufjs, etc.), so the established fix is to advance the override to the patched version rather than ignore the finding. form-data and @opentelemetry/core were not previously overridden, so new override entries were added.

• All bumps stay within the same major version, so the bundled consumers (@scalar/api-reference, typesense, the OTLP transformer) are unaffected.
• dompurify’s worst advisory (GHSA-x4vx-rjvf-j5p4) has vulnerable range <= 3.4.6; 3.4.10 is outside it.
• @opentelemetry/core 2.8.0 is required because the current Trivy DB lists CVE-2026-54285 as fixed only in 2.8.0 (the earlier 2.6.1 patch claim was revised). The bump also dedupes the two @opentelemetry/core copies in the lockfile to a single tree entry.

Why not .trivyignore

The root .trivyignore is only wired into the Docker image scan (trivy image --ignorefile "$GITHUB_WORKSPACE/.trivyignore"); the trivy fs scan in security.sh reads .trivyignore from its cwd (server/), where none exists. These are all fixed upstream, so patching is preferable to suppressing.

Validation

• trivy fs --exit-code 1 --skip-files mix.exs,mix.lock --skip-dirs priv/static,node_modules,deps,_build ./ now exits 0 (was exit 1 with 12 findings; verified locally against a freshly downloaded Trivy DB).
• aube install resolves cleanly with all peer dependencies satisfied; lockfile shows single resolved versions: dompurify@3.4.10, protobufjs@7.6.4, form-data@4.0.6, @opentelemetry/core@2.8.0.

🤖 Generated with Claude Code