fix(deps): patch frontend dompurify and @babel/core advisories (#1539)

Bump the frontend dependency overrides to force patched versions of two
packages flagged by security advisories:

- dompurify: monaco-editor pins 3.2.7, which the existing override raised
  only to 3.4.1. Raise the override to ^3.4.11 so the resolved version is
  3.4.11, clearing eight dompurify advisories (IN_PLACE and template
  sanitization bypasses, hook/config pollution, Trusted Types poisoning).
- @babel/core: force the transitive build-time dependency from 7.29.0 to
  ^7.29.6 (resolves to 7.29.7), clearing the sourceMappingURL arbitrary
  file read advisory. Its consumers accept ^7.0.0 / ^7.24.4.

dompurify is not imported in application code; it reaches the bundle only
through monaco-editor, so the override is the correct control point.

Lock churn is limited to the @babel/* subtree, the browserslist toolchain
data packages, and dompurify. Typecheck, production build, and the full
frontend test suite (1613 tests) pass.

frontend/package.json

@@ -63,7 +63,8 @@
     "yaml": "^2.9.0"
   },
   "overrides": {
-    "dompurify": "^3.4.0"
+    "dompurify": "^3.4.11",
+    "@babel/core": "^7.29.6"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",