chore: pin @asyncapi/specs to 6.11.1

[Patrycja-dz]

Fixes #2999

Summary

• @asyncapi/specs 6.11.2 and 6.11.2-alpha.1 were compromised on July 14, 2026 — malicious code injected via the upstream alpha branch executes on package import and downloads a credential-stealing RAT (browser passwords, SSH keys, npm/GitHub/AWS tokens). See [SECURITY] Malicious versions published via compromised alpha branch - @asyncapi/specs@6.11.2 (latest) and 6.11.2-alpha.1 asyncapi/spec-json-schemas#656.
• The caret range ^6.8.0 allowed any consumer of @stoplight/spectral-rulesets to resolve the malicious 6.11.2 (currently tagged latest on npm) on a fresh install.
• 6.11.1 (published Jan 30, 2026) is the last known-safe version; the exact pin (no ^/~) removes any upgrade path into the compromised release.
• Picks up ~10 releases of legitimate AsyncAPI schema updates over the previously locked 6.8.0.
• Regenerates the yarn.lock entry (resolution + integrity checksum) for the new version.
• Updates the asyncapi2-streetlights test-harness scenario: the asyncapi-latest-version diagnostic now reports 3.1.0, since @asyncapi/specs 6.11.1 ships the AsyncAPI 3.1.0 schema (6.8.0's newest was 3.0.0). Intentional, data-driven behavior - the rule interpolates the latest version known to the package.

---

Security notes

• This repo's own yarn.lock was never resolving the malicious version (it held 6.8.0) — the exposure is for downstream npm consumers of the published package, so a patch release of @stoplight/spectral-rulesets should follow this merge.
• yarn why @asyncapi/specs confirms a single resolution at 6.11.1 — no other version anywhere in the dependency tree.
• Follow-up: once upstream publishes a clean 6.11.3+ and npm removes the malicious versions, this pin can move forward (recommend keeping exact or ~, not ^).

---

Test plan

• yarn install — lockfile regenerated, single clean resolution at 6.11.1
• compile-schemas (packages/rulesets pretest) — passes against 6.11.1
• yarn test.jest -- asyncapi — 58/58 suites, 377/377 tests pass
• Verified CLI output for the streetlights sample matches the updated scenario line-for-line

Does this PR introduce a breaking change?

• Yes
• No