v1.1.2

Dependency security fixes.

npm audit findings: 47 -> 7 (3 critical + 37 high -> 0 critical, 7 high).

• Cleared the criticals (vitest, protobufjs) and the bulk of the highs via npm audit fix.
• Scoped npm overrides for the rest of the appium-mcp / webdriver subtree: deepmerge-ts ^8.0.2, mocha ^11.8.0 (with nested diff / serialize-javascript), and applesign's uuid ^11.1.1.
• Bumped @testingbot/automation-mcp to ^0.1.6, which carries the same fixes upstream.
• Added a least-privilege permissions: contents: read block to the test workflow.

Remaining 7 findings are a single root cause reported at each level of the chain: @puppeteer/browsers@2 -> extract-zip, which has no patched release. @puppeteer/browsers@3 drops it but requires Node >=22.12.0, which would drop Node 18/20 support.

No functional changes.