chore: consolidate pnpm audit security overrides

[simeng-li]

Summary

Follow-up cleanup of a fresh pnpm audit --fix run, which appended a new batch of overrides on top of the existing block without deduplicating or aligning syntax (same tidy-up as the previous overrides PR).

What changed

• Deduplicated overlapping new entries:
  • @angular/core (2 → 1) and @angular/common (2 → 1), each merged to the highest fix target (^20.3.25).
  • vite (3 entries → 2, one per major line): vite@<=6.4.2: ^6.4.3 and vite@>=7.0.0 <=7.3.4: ^7.3.5.
• Aligned new >= targets to caret (^) and folded into the alphabetical list: @babel/core, form-data, js-yaml, launch-editor, tar.
• Regenerated pnpm-lock.yaml.

Deferred (unchanged from the prior overrides PR)

The audit re-appended the two bumps that require accompanying code changes; they remain deferred to a dedicated PR and are not applied here:

• esbuild → ^0.28.1 (kept at ^0.25.0) — breaks the vite-based sample builds without a build.target change.
• nuxt → ^3.21.6 (override omitted) — breaks @logto/nuxt's nitro:config typing without a NuxtHooks augmentation.

As a result pnpm audit still reports those advisories (1 high esbuild + 3 nuxt) — expected, deferred.

Testing

Tested locally — full pnpm -r build and pnpm -r test pass; pnpm audit reports only the deferred esbuild/nuxt advisories.

Checklist

• `.changeset`
• unit tests
• integration tests
• necessary TSDoc comments