[hdcodedev]

Summary

• Delete kotlin-js-store/yarn.lock. No build has read it since the demo moved to Wasm (chore(web): migrate demo to Wasm #488), and all 5 open Dependabot alerts (shell-quote, source-map-js, proxy-addr, compression, braces) come from it.
• Remove configureJsSecurityOverrides and its six npm *-security versions. These Yarn resolutions only reach the JS Yarn root, which has no packages, so they never pinned anything.
• Wasm uses its own lock, kotlin-js-store/wasm/yarn.lock (unchanged). Its test tooling (karma, webpack, mocha) comes from the Kotlin plugin's bundled install, which has its own lock. The removed resolutions never reached either one. build/wasm/package.json has "resolutions": {} both before and after this change.
• The Gradle overrides (protobuf, jdom, commons-lang3, httpclient, jose4j, jackson-core, logback) stay. Each still raises an older vulnerable version that something requests, for example dokka asking for jackson-core 2.15.3.

Dependabot alerts on kotlin-js-store/yarn.lock:

• #115 shell-quote
• #114 source-map-js
• #113 proxy-addr
• #112 compression
• #111 braces

Local Validation

• ./gradlew ktlintCheck
• ./gradlew :charts-<module>:jvmTest
• ./gradlew chartsTestJvm
• ./gradlew ciCompile
• ./gradlew chartsCheck
• ./gradlew apiCompatibilityCheck
• ../charts-playground/gradlew -p ../charts-playground -DchartsLocalPath="$PWD" ciCompile
• ./gradlew :androidApp:validateDebugScreenshotTest
• ./gradlew updateScreenshots

Also ran ./gradlew kotlinWasmNpmInstall kotlinWasmToolingSetup kotlinWasmStoreYarnLock. All three passed and kotlin-js-store/wasm/yarn.lock was unchanged.