DOC-3386 - Consolidate dependency security fixes

[kemister85]

Ticket: DOC-3386

Site: N/A (dependency-only change, no content changes)

Changes:

• Upgrade http-server from ^0.12.3 to ^14.1.1 (v14 drops ecstatic)
• Remove ecstatic devDependency (no longer needed)
• Add yarn resolutions for 11 transitive vulnerabilities:

Package	Resolution	Advisory
brace-expansion	>=1.1.13	ReDoS + zero-step hang
convict	>=6.2.5	Prototype pollution
follow-redirects	>=1.16.0	GHSA-r4q5-vmmm-2653
handlebars	>=4.7.9	Multiple security fixes
js-yaml	>=4.1.1	Code execution via load()
liquidjs	>=10.25.5	GHSA-v273-448j-v4qj
lodash	>=4.18.1	Prototype pollution + template injection
minimatch	>=3.1.4	ReDoS
picomatch	>=2.3.2	GHSA-3v7f-55p6-f55p
qs	>=6.14.2	Prototype pollution
sha.js	>=2.4.12	Collision vulnerability

Result: yarn audit reports 0 vulnerabilities. Build and serve both work.

Supersedes #4028, #4093, #4094, #4102, #4120, #4121, #4122. Once merged, those PRs can be closed.

Pre-checks:

• Branch prefixed with fix/.
• modules/ROOT/nav.adoc has been updated (if applicable). N/A — no content changes.
• Included a release note entry for any New product features. N/A.
• If this is a minor release, updated productminorversion in antora.yml and added new supported versions entry in modules/ROOT/partials/misc/supported-versions.adoc. N/A.

Review:

• Documentation Team Lead has reviewed