Regenerate the outdated package-lock.json (minimatch 3.0.4 ReDoS advisories) [#3633402]

Problem/Motivation

The module ships a package-lock.json in the old npm 6 format (lockfileVersion: 1). It resolves minimatch to 3.0.4, which has four high-severity ReDoS advisories:

GHSA-f8q6-p94x-37v3 (CVE-2022-3517), fixed in 3.0.5
GHSA-3ppc-4f35-3m26, fixed in 3.1.3
GHSA-7r86-cg39-jmmj, fixed in 3.1.3
GHSA-23c5-xmqv-rm74, fixed in 3.1.4

minimatch comes in through the dev tooling (eslint, @eslint/eslintrc, @humanwhocodes/config-array, glob), which all accept ^3.0.4. Nothing of it is shipped to the browser, so there is no runtime risk. But dependency scanners (npm audit, Snyk, Dependabot, SBOM tools like DruBOM) report these findings against every site that installs the module.

There is also a tooling mismatch. package.json declares "packageManager": "yarn@1.22.22", but the repository has no yarn.lock, only the npm lock file.

Steps to reproduce

Check out 2.x.
jq '.lockfileVersion, .dependencies.minimatch.version' package-lock.json prints 1 and "3.0.4".
npm audit lists the minimatch advisories above.

Proposed resolution

Choose one package manager. Either:
- keep npm: drop the packageManager field, delete package-lock.json and regenerate it with npm install --package-lock-only (current npm writes lockfileVersion: 3); or
- keep Yarn: replace package-lock.json with a yarn.lock.
Commit the regenerated lock file.

I tested the npm variant locally: the new lock resolves minimatch to 3.1.5 and all four advisories are gone. No package.json change is needed.

Follow-up (not part of this issue): npm audit then still reports old postcss 7 copies pulled in by stylelint 13, postcss-calc 7, postcss-custom-properties 10 and postcss-discard-comments 4. Fixing those needs major-version updates of the CSS tooling.