chore: update yanked transitive crates (js-sys, wasm-bindgen)

## Summary

`cargo deny check` reports two yanked transitive crate versions:

- `js-sys v0.3.86` — yanked
- `wasm-bindgen v0.2.109` — yanked

Both are pulled in transitively via `sevenz-rust2 v0.20.2`.

## Fix

```bash
cargo update -p js-sys
cargo update -p wasm-bindgen
```

Then verify `cargo deny check` and `cargo nextest run` pass.