Fix transitive dep CVEs via npm overrides

[mraible]

Add npm overrides and update rollup 4.50.2 to 4.59.0 to fix transitive dependencies with known CVEs:

• js-yaml 3.14.2 (arbitrary code execution)
• lodash 4.17.23 (prototype pollution)
• svgo 2.8.1 (DoS entity expansion)
• minimatch 3.x/9.x (ReDoS)
• rollup 4.59.0 (path traversal)

Build passes, 23 tests pass. npm audit shows 0 vulnerabilities.