Update js-yaml to ~4.2.0 to address GHSA-h67p-54hq-rp68

[Copilot]

js-yaml ~4.1.0 has a known advisory (GHSA-h67p-54hq-rp68) for poor performance characteristics with certain input (ReDoS-class behavior). Bumping to ~4.2.0 resolves it.

Changes

• libraries/rush-lib/package.json — bump js-yaml ~4.1.0 → ~4.2.0
• apps/api-documenter/package.json — same
• apps/lockfile-explorer/package.json — same
• repo-scripts/doc-plugin-rush-stack/package.json — same
• common/config/subspaces/default/pnpm-lock.yaml — rush update resolves to js-yaml@4.2.0
• common/changes/@microsoft/rush/ — change file with bump type none

[David Michon (dmichon-msft)]

Copilot Rebase this and regenerate the lockfile updates

[Copilot]

Copilot Rebase this and regenerate the lockfile updates

The rebase is done locally — the branch is now on top of origin/main with all changes intact (lockfile specifiers correctly read ~4.2.0 → 4.2.0). However, the push infrastructure is currently returning a GPG signing error (Bad Request from the signing service), which is preventing the force-push from landing. This appears to be a transient service issue on the infrastructure side; retrying once it clears should get the rebased commits up.

[David Michon (dmichon-msft)]

Copilot; revert the lockfile, rebase onto latest, then rerun rush update to regenerate and commit the lockfile