Bump vite in UI packages to patched releases

[arpitjain099]

Summary

• Bump vite to patched ranges in both UI package manifests:
  • airflow-core/src/airflow/ui/package.json: ^5.4.17 -> ^5.4.18 (resolves to 5.4.21 in lockfile)
  • airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui/package.json: ^6.2.6 -> ^6.4.2
• Refresh related lockfiles:
  • both pnpm-lock.yaml files
  • package-lock.json in the simple auth UI package

Why

Dependabot flags multiple vulnerabilities in vulnerable Vite ranges used by these UI packages (including advisories patched in 5.4.18+ and 6.4.2+). This updates the direct dependency constraints and lockfiles to patched versions.

Validation

• pnpm install --frozen-lockfile --ignore-scripts in airflow-core/src/airflow/ui
• pnpm install --frozen-lockfile --ignore-scripts in airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui
• npm ci --ignore-scripts --legacy-peer-deps in airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui

[bbovenzi]

Merge conflicts

[arpitjain099]

@bbovenzi rebased and same story as #66797 - moot. Main has moved vite to ^8.0.8 and ^8.0.10 in the two UIs, while this PR was bumping to ^5.4.18 / ^6.4.2. Both bumps have been superseded. Closing.