Upgrade the eight shipped dependencies carrying advisories

Clears every shipped finding the SBOM scan reported: pyjwt 2.13.0, idna 3.19,
axios 1.20.0, postcss 8.5.26, dompurify 3.4.14, nanoid 3.3.18, follow-redirects
1.16.0, form-data 4.0.6. All in-major bumps inside ranges the manifests already
allowed, so this is a lockfile refresh rather than a migration.

The axios and dompurify floors were raised to match, since the old ones still
nominally admitted the vulnerable range.

The PyJWT allowlist entry was removed rather than kept - it stopped matching once
the upgrade landed.

Verified: full suite 2161 passed, frontend 273 passed, build clean, npm audit
--omit=dev reports 0 vulnerabilities.

scripts/vulnerability-allowlist.json

@@ -8,20 +8,16 @@
     "An entry needs an id, a reason that names the precondition that is",
     "absent, who accepted it, and when. 'reviewuntil' is when the reasoning",
     "should be checked again - a reason stops being true when the code that",
-    "made it true changes.",
+    "made it true changes, and 'invalidatedby' should say what that change",
+    "would be.",
+    "",
+    "Currently EMPTY, which is the state to aim for. The one entry this file",
+    "has held so far - a PyJWT algorithm-confusion advisory that needed a",
+    "configuration this application does not use - was removed by upgrading",
+    "PyJWT rather than by keeping the exception.",
     "",
     "Do NOT add an entry to make a build pass. Upgrading the dependency is",
     "almost always cheaper than defending a decision to skip it."
   ],
-  "accepted": [
-    {
-      "id": "GHSA-xgmm-8j9v-c9wx",
-      "component": "pyjwt",
-      "reason": "Needs a verifier configured with BOTH symmetric and asymmetric algorithms and a raw JSON JWK passed as key=. Neither is present: auth goes through flask-jwt-extended with no JWT_ALGORITHM or JWT_DECODE_ALGORITHMS override anywhere in the tree, so it is HS256-only, and the key is the JWT_SECRET_KEY string. Upstream rates the attack complexity High for exactly this reason. Upgrade to pyjwt 2.13.0 anyway at the next dependency bump; this entry only says it is not urgent.",
-      "acceptedby": "DT team, reference site",
-      "accepted": "2026-08-29",
-      "reviewuntil": "2026-11-29",
-      "invalidatedby": "Setting JWT_ALGORITHM or JWT_DECODE_ALGORITHMS to anything asymmetric, or moving to SSO-issued tokens verified against a JWK."
-    }
-  ]
+  "accepted": []
 }