Fix blocked Dependabot security updates

[floitsch]

Dependabot security updates fail with security_update_not_possible for js-yaml, SVGO, qs, and postcss-selector-parser. This updates the lockfile to patched releases and adds the resolutions needed to unblock the older transitive dependencies.

• Upgrade @svgr/webpack to 6.5.1, compatible with the existing Webpack 5 setup, removing SVGO v1 and using SVGO 2.8.4.
• Resolve qs to 6.16.0 across the older constraints in Express, body-parser, and Cypress's request library.
• Update js-yaml to 3.15.2 / 4.3.2 and postcss-selector-parser to 6.1.4 / 7.1.6, preserving the major versions required by their consumers.
• Document the overrides and make the browser smoke test honor Cypress's configured base URL.

Validation: frozen offline Yarn install, lint, all 7 unit tests, production build, and prerendering passed. All 14 browser tests passed across runs; the SEO and UI specs required a retry with a longer command timeout and video disabled after a timeout and Chromium renderer crash. Browser tests used port 3187 because port 3000 was occupied.

Checked the updated lockfile against all 17 open GitHub alerts for these four packages: no installed versions remain in their affected ranges. This addresses those packages, not the repository's entire security-alert backlog. Existing js-yaml PR #327 targets 3.15.1 and is superseded by this update.