chore: release-1.9: update underscore and node-forge to fix CVEs

[kim-tsao]

Description

Please explain the changes you made here.

• Ran yarn up -R underscore/node-forge to update the packages
• Could not update the underscore transitive dependency of @backstage/cli but it's ok because the cli is a dev dependency.

Which issue(s) does this PR fix

• Fixes #?
  CVE-2026-27601
  CVE-2026-33891

RHDHBUGS-2973
RHIDP-13184

PR acceptance criteria

Please make sure that the following steps are complete:

• GitHub Actions are completed and successful
• Unit Tests are updated and passing
• E2E Tests are updated and passing
• Documentation is updated if necessary (requirement for new features)
• Add a screenshot if the change is UX/UI related

How to test changes / Special notes to the reviewer

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-4634
• quay.io/rhdh-community/rhdh:pr-4634-b35e3457

[kim-tsao]

/test e2e-ocp-helm

[JessicaJHee]

edit: missed comment above:

Could not update the underscore transitive dependency of @backstage/cli but it's ok because the cli is a dev dependency.

Looks like there's still 1.13.6 present for underscore which is vulnerable

[JessicaJHee]

/lgtm