Fix critical dependency vulnerabilities

[DavidBabinec]

What changed

• pin patched transitive JavaScript dependencies, removing all critical advisories
• update PHP_CodeSniffer to 3.13.6, clearing the Composer advisory
• add critical JavaScript and PHP dependency audit gates to CI and tagged releases

Why

The public release dependency graph contained two critical JavaScript advisories in WordPress development tooling and one high PHP development-tool advisory. Compatible patched versions were available without changing application runtime behavior.

Impact

• JavaScript advisories reduced from 72 to 41
• critical JavaScript advisories reduced from 2 to 0
• Composer advisories reduced from 1 to 0
• future critical JavaScript or Composer advisories now fail CI and release verification

Validation

• bun install --frozen-lockfile
• bun audit --audit-level=critical
• composer audit --locked --no-interaction
• 147 web tests
• 21 PHP tests
• web, WordPress, Figma, Gutenberg, blocks, and builder builds
• workflow YAML validation