chore(deps): collapse stale transitive js-yaml pins onto the patched releases (#6830)

GHSA-5p4m-2wfm-xmqj (quadratic CPU in !!omap resolution) is patched in js-yaml
4.3.1 and 3.15.1. Both direct dependents already pin 4.3.1, but bun.lock still
held ten stale nested resolutions — 4.2.0, 4.3.0, and 3.14.2 — under fumadocs,
electron-builder/updater, gray-matter, and json-schema-to-typescript.

Every one of those ranges (^4.1.0, ^4.1.1, ^3.13.1) already admits the patched
release, so this is a lockfile-only dedupe: no manifest change and no overrides
block, which would force gray-matter's 3.x range onto js-yaml 4 and break it.

Author: waleedlatif1