Fix Dependabot security alerts: replace serde_yml, update npm deps

[ewels]

Summary

• Replace serde_yml with serde_yaml_ng — fixes Dependabot alerts Add release process with cross-platform binaries and Docker container #1 (high: libyml unsound/unmaintained) and feat: add SAM and CRAM input support #2 (medium: serde_yml unsound/unmaintained). serde_yaml_ng is the actively maintained successor with a compatible API, making this a drop-in replacement.
• Update npm transitive dependencies in docs/ — fixes alerts Add duplicate-marking validation for BAM files #3 and Add plot titles showing BAM filename and fix boxplot layout #4 (low: devalue prototype pollution / CPU amplification) and feat: support multiple BAM files with parallel processing #5 (high: rollup path traversal).

Changes

File	Change
Cargo.toml	serde_yml = "0.0.12" → serde_yaml_ng = "0.10"
src/config.rs	serde_yml::from_str → serde_yaml_ng::from_str (9 call sites)
Cargo.lock	Updated lockfile (removes serde_yml + libyml, adds serde_yaml_ng + unsafe-libyaml)
docs/package-lock.json	Updated transitive deps to patched versions

Verification

• All 151 tests pass (139 unit + 12 integration)
• cargo clippy -- -D warnings clean
• cargo fmt --check clean
• npm audit reports 0 vulnerabilities