[Security upgrade] bump js-yaml to 4.2.0 in root workspace (#34925)

* [Security upgrade] bump js-yaml 4.1.1 -> 4.2.0 in root workspace

GHSA-h67p-54hq-rp68, patched in 4.2.0. js-yaml 4.x is pulled at runtime via
the patched referer-parser (web) plus many dev/build consumers.

Bumped the existing scoped resolution referer-parser/js-yaml ^4.1.1 -> ^4.2.0
(security floor on the patched-parent path) and re-resolved all 4.x to 4.2.0
(yarn up -R). The js-yaml 3.x line (3.14.2) is a different major, unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Bump js-yaml range in referer-parser patch to ^4.2.0 for consistency

The referer-parser/js-yaml resolution override forces js-yaml to 4.2.0,
but the local patch still declared ^4.1.0. Align the patch's declared
range with the resolution. Addresses Jakob's review comment on #34695
(discussion_r3440549168).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Make patched-parent realignment a mandatory Type B step in yarn-security-update skill

The patch-realignment instruction was a soft 'for consistency' parenthetical;
a session reading the rule acted only on 'use a resolution' and dropped the
patch edit, leaving the resolution at ^4.2.0 while the referer-parser patch
still declared ^4.1.0 (PR #34925). Promote it to an explicit mandatory step.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Fully resolve js-yaml to 4.2.0 and stop patching its range in referer-parser

Add a scoped resolution for @istanbuljs/load-nyc-config/js-yaml so the last
sub-4.2.0 instance (3.14.2, GHSA-h67p-54hq-rp68) is forced to 4.2.0 too;
load-nyc-config uses js-yaml.load(), which is 4.x-compatible.

Drop the js-yaml and mocha dependency edits from the referer-parser patch:
editing a patched package's dependencies has no effect on resolution, so the
scoped resolution is the entire fix. Update the yarn-security-update skill to
match (patched parents route to Type B; do not edit the patch).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Combine js-yaml resolutions into a single global override

Replace the two scoped js-yaml resolutions (referer-parser/js-yaml and
@istanbuljs/load-nyc-config/js-yaml) with one global "js-yaml": "^4.2.0". Every
js-yaml consumer should reach the security floor and none needs an older major,
so the global override is equivalent and tidier (reviewer request).

Note the scoped-vs-global tradeoff in the yarn-security-update skill.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 1738cbc04f4cacbfb6880ba6f176a192aa4a03f7

.yarn/patches/referer-parser-npm-0.0.3.patch

@@ -9,18 +9,6 @@ diff --git a/package.json b/package.json
    "description": "library for extracting marketing attribution data (such as search terms) from referrer URLs",
    "main": "index.js",
    "scripts": {
-@@ -15,9 +15,9 @@
-     }
-   ],
-   "dependencies": {
--    "js-yaml": "~2.1.0"
-+    "js-yaml": "^4.1.0"
-   },
-   "devDependencies": {
--    "mocha": "~1.12.0"
-+    "mocha": "~10.2.0"
-   }
- }
 diff --git a/index.js b/index.js
 --- a/index.js
 +++ b/index.js