Security: Fix Dependabot alerts in DevExtreme repository

[Raushen]

No description provided.

[Copilot]

Pull request overview

This PR updates the monorepo’s dependency resolution to address Dependabot security alerts by adding/adjusting pnpm.overrides at the workspace root and regenerating the root lockfile so vulnerable transitive versions are no longer selected.

Changes:

• Expanded root pnpm.overrides to force patched versions of tar, underscore, hono, @hono/node-server, express-rate-limit, and immutable.
• Updated root pnpm-lock.yaml to reflect the newly resolved versions (e.g., tar, underscore, hono, express-rate-limit, ip-address, immutable).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File	Description
package.json	Adds new root-level pnpm.overrides entries to force patched dependency versions.
pnpm-lock.yaml	Regenerates lockfile to pick up the overridden/patched package versions.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

[Copilot]

Root overrides now cover tar<=7.5.9, but the workspace package packages/sbom still has its own pnpm.overrides and lockfile that keep tar@7.5.9 (see packages/sbom/pnpm-lock.yaml). If Dependabot is scanning all workspace lockfiles, this PR may not clear the tar alert until packages/sbom/package.json override and its lockfile are updated/regenerated as well.

[Copilot]

The new root override forces immutable to 5.1.5+, but packages/devextreme-themebuilder/package.json still declares immutable: "5.1.4". Root pnpm overrides won’t apply to consumers installing devextreme-themebuilder directly, and this can also cause lockfile drift on future installs. Consider updating the package’s declared dependency to 5.1.5+ (and then regenerating the lockfile) instead of relying solely on the workspace override.