chore(deps): bump up decode-uri-component and browserslist

[SB-virendrasolanke]

Motivation and Context

https://smartbear.atlassian.net/browse/STOP-6414
https://smartbear.atlassian.net/browse/STOP-6411

Description

Patches two security vulnerabilities found in transitive dependencies by pinning fixed versions via yarn resolutions.

Vulnerabilities Fixed
CVE-2026-73088 — browserslist@4.23.0

normalizeStats() in node.js processes untrusted browserslist-stats.json using an unguarded for...in loop.
Allows an attacker who can place a malicious browserslist-stats.json in the project tree to crash the build (DoS via uncaught TypeError) or pollute object prototypes.
Affects any tool that invokes Browserslist internally (Autoprefixer, Babel, PostCSS, Stylelint).
Fix: bumped resolution from 4.23.0 → 4.28.8.
CVE-2026-45822 — decode-uri-component@0.2.1

Crafted input to decodeUriComponent() causes excessive CPU consumption and event-loop blocking (ReDoS-style DoS).
No known memory corruption, data disclosure, or RCE impact.
Fix: bumped resolution from 0.2.1 → 0.2.2.
Changes
package.json: updated resolutions entries for browserslist (4.23.0 → 4.28.8) and decode-uri-component (0.2.1 → 0.2.2).
yarn.lock: regenerated via yarn install to reflect the patched versions across all dependents.

How Has This Been Tested?

Confirmed via yarn.lock that all transitive references now resolve to a single patched version:
browserslist@4.28.8 (previously 4.23.0, invalid/multiple versions)
decode-uri-component@0.2.2 (previously 0.2.1)
yarn install completed successfully with Saved lockfile.

Screenshot(s)/recordings(s)

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

• This PR's code follows as closely as possible the coding style/guidelines of this project.
• I have added error reporting and followed the error reporting guidelines.
• I have added event tracking and followed the event tracking guidelines.
• I have updated any relevant documentation accordingly to reflect this PR's changes.
• I have added automated tests (unit/integration/e2e/other) to cover my changes.
• All new and existing tests pass locally (excluding flaky CI tests).