fix(deps): pin the remaining vulnerable transitive dependencies

Roughly 70% of the advisories still open after #736 came from four transitive
packages, each reached through a small number of paths, so pinning them resolves
the advisories without moving any example's own dependencies.

The pins are scoped per major. A bare-name pnpm override replaces every version
of a package regardless of what the consumer asked for, which would force
unrelated consumers across a major: an unscoped ws pin dropped
@solana/rpc-subscriptions-channel-websocket from ws 8.21.1 to 7.5.13, and
base-x 4.x and 5.x down to 3.x. Scoping patches each affected major in place and
leaves clean majors alone:

  js-yaml  ^3.15.2 / ^4.3.2              via mocha
  ws       ^6.2.6 / ^7.5.11 / ^8.21.3    via jayson, rpc-subscriptions, others
  bn.js    ^4.12.3 / ^5.2.3              via @anchor-lang/core and web3.js
  base-x   ^3.0.11 / ^4.0.1              via bs58, 5.x untouched

uuid is scoped to the 8.x and 9.x paths, which have no in-major patch and move
to 11. The 14.x copy under rpc-websockets was never affected and is left alone;
#736's unscoped uuid pin had been downgrading it.

Drop the diff pin from #736 entirely. diff has no Dependabot advisory against
it, so the pin only forced consumers across majors for no benefit.

toml and serialize-javascript stay unscoped deliberately: only one major of each
is present and neither has an in-major patched release, so moving major is the
only way to resolve those advisories.

Bump axios to ^1.18.0 in the three compression examples, where it is a direct
dependency. The axios 0.x copy under @metaplex-foundation/js is untouched: that
tree needs the example ported off unmaintained packages, not a version bump.

Lockfiles are regenerated with pnpm install --lockfile-only, so no other
resolution moves. Verified with pnpm install --frozen-lockfile plus
pnpm exec tsc --noEmit across all 107 projects, which matches main exactly at
57 pass and 0 install failures with no regressions, the root --ignore-workspace
install, and prettier.

Author: dev-jodee

basics/account-data/anchor/pnpm-lock.yaml

@@ -1,5 +1,14 @@
 overrides:
   toml: ^5.0.0
   serialize-javascript: ^7.1.1
-  uuid: ^11.1.1
-  diff: ^8.0.3
+  'js-yaml@^3.0.0': ^3.15.2
+  'js-yaml@^4.0.0': ^4.3.2
+  'ws@^6.0.0': ^6.2.6
+  'ws@^7.0.0': ^7.5.11
+  'ws@^8.0.0': ^8.21.3
+  'bn.js@^4.0.0': ^4.12.3
+  'bn.js@^5.0.0': ^5.2.3
+  'base-x@^3.0.0': ^3.0.11
+  'base-x@^4.0.0': ^4.0.1
+  'uuid@^8.0.0': ^11.1.1
+  'uuid@^9.0.0': ^11.1.1

basics/account-data/anchor/pnpm-workspace.yaml

@@ -1,5 +1,14 @@
 overrides:
   toml: ^5.0.0
   serialize-javascript: ^7.1.1
-  uuid: ^11.1.1
-  diff: ^8.0.3
+  'js-yaml@^3.0.0': ^3.15.2
+  'js-yaml@^4.0.0': ^4.3.2
+  'ws@^6.0.0': ^6.2.6
+  'ws@^7.0.0': ^7.5.11
+  'ws@^8.0.0': ^8.21.3
+  'bn.js@^4.0.0': ^4.12.3
+  'bn.js@^5.0.0': ^5.2.3
+  'base-x@^3.0.0': ^3.0.11
+  'base-x@^4.0.0': ^4.0.1
+  'uuid@^8.0.0': ^11.1.1
+  'uuid@^9.0.0': ^11.1.1