fix(deps): secure legacy request multipart boundaries

[infeng]

The retired development dependency request pins form-data to vulnerable 2.3.x. With a predictable Math.random, two fresh forms generate the same multipart boundary. Add a scoped npm override selecting form-data 2.5.6 for request, fixing critical alert #223 and the later boundary advisory #324 while retaining its current API major.

Add npm run check:multipart to full verification and both CI jobs. It resolves the actual form-data used by request, reproduces predictable boundary generation, and exercises an HTTP text/binary upload against a local server, including headers, boundary framing and content length. Document why the override exists and when to remove it.

Validation:

• The new boundary check failed on form-data 2.3.3 before the override and passed on 2.5.6 afterward.
• Clean public-registry install and npm run verify passed, including 42 viewer tests, lint, library/demo/SSR builds, default-export and hydration checks, multipart upload and package dry run.
• git diff --check passed; rebase onto the merged Babel batch retained the exact tested tree.

Predictable-boundary advisory, follow-up advisory. Other request/jsdom advisories remain separate maintenance work; this PR does not claim those obsolete parents are fully secure.