security: add npm overrides to fix 15 transitive dep vulnerabilities

All affected packages are development dependencies only and do not
affect the compiled plugin that users install.

Overrides added (minimum safe versions):
- ajv: ^6.14.0 (was 6.12.6, ReDoS)
- brace-expansion: ^1.1.13 (was 1.1.11, ReDoS)
- braces: ^3.0.3 (was 3.0.2, uncontrolled resource consumption)
- cross-spawn: ^7.0.5 (was mixed 6/7, ReDoS)
- flatted: ^3.4.2 (was 3.2.7, prototype pollution + DoS)
- immutable: ^4.3.8 (was 4.1.0, prototype pollution)
- js-yaml: ^4.1.1 (was 4.1.0, prototype pollution)
- micromatch: ^4.0.8 (was 4.0.5, ReDoS)
- minimatch: ^3.1.5 (was 3.1.2, ReDoS)
- nanoid: ^3.3.8 (was 3.3.4, predictable output)
- picomatch: ^2.3.2 (was 2.3.1, method injection + ReDoS)
- postcss: ^8.5.10 (was 8.4.20, parsing error + XSS)
- semver: ^7.5.2 (was mixed, ReDoS)
- word-wrap: ^1.2.4 (was 1.2.3, ReDoS)
- yaml: ^1.10.3 (was 1.10.2, stack overflow)

package.json

@@ -47,5 +47,22 @@
 		"array-move": "^4.0.0",
 		"canvas-confetti": "^1.6.0",
 		"preact": "^10.11.3"
+	},
+	"overrides": {
+		"ajv": "^6.14.0",
+		"brace-expansion": "^1.1.13",
+		"braces": "^3.0.3",
+		"cross-spawn": "^7.0.5",
+		"flatted": "^3.4.2",
+		"immutable": "^4.3.8",
+		"js-yaml": "^4.1.1",
+		"micromatch": "^4.0.8",
+		"minimatch": "^3.1.5",
+		"nanoid": "^3.3.8",
+		"picomatch": "^2.3.2",
+		"postcss": "^8.5.10",
+		"semver": "^7.5.2",
+		"word-wrap": "^1.2.4",
+		"yaml": "^1.10.3"
 	}
 }