fix(deps): bump fast-uri past 4 HIGH advisories in both lockfiles

[isadeks]

What happened

security-pr fails on main and therefore on every PR branched from or merged with it. osv-scanner reports 8 findings across two lockfiles, all one package:

Total 2 packages affected by 8 known vulnerabilities
(0 Critical, 8 High, 0 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
8 vulnerabilities can be fixed.

| OSV URL                             | CVSS | PACKAGE  | VERSION | FIXED |
| GHSA-5jgf-p345-68v8                 | 7.5  | fast-uri | 3.1.5   | 3.1.6 |
| GHSA-f65p-4m7j-42xc                 | 7.5  | fast-uri | 3.1.5   | 3.1.6 |
| GHSA-fph4-wmhf-6fwf                 | 7.5  | fast-uri | 3.1.5   | 3.1.6 |
| GHSA-jqff-g426-hqxp                 | 7.5  | fast-uri | 3.1.5   | 3.1.6 |

Four distinct HIGH advisories, each reported once per lockfile:

• GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization
• GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme
• GHSA-f65p-4m7j-42xc — SSRF via malformed IPv6
• GHSA-fph4-wmhf-6fwf — SSRF via repeated host separators

fast-uri is transitive (via ajv), and pins already exist in both places — both at ^3.1.5, which resolves to the vulnerable version:

• package.json → resolutions
• integrations/jira-forge-app/package.json → overrides

Why it needs both places

integrations/jira-forge-app is a standalone npm project outside the yarn workspaces, so a root resolutions bump does not reach it — the pin has to be mirrored and its package-lock.json re-locked separately. This is the case check:transitive-pin-sync exists for (#712).

Fix

Bump both pins to ^3.1.6 and re-resolve both lockfiles — no source change:

# root
yarn install
# forge app (outside the workspaces)
cd integrations/jira-forge-app && npm install --package-lock-only

Both resolve to 3.1.7. Verified locally: mise run security:deps exits 0, and
mise run drift-prevention reports check-transitive-pin-sync: OK — 4 shared pin(s) in sync.

Other information

Same shape as #637/#636 (lockfile-only re-resolve to clear OSV advisories). Filing this as the tracking issue for that work rather than folding the bump into an unrelated in-flight PR — it currently blocks CI on #705, which did not introduce it.