Update shell-quote, source-map-js and form-data for security fixes

[rthaut]

Clears the critical and high npm Dependabot alerts that have a fix. All are dev dependencies.

• shell-quote 1.10.0 -> 1.12.0 (alert Bump normalize-url from 4.5.0 to 4.5.1 #180). The npm-run-all copy updates through the lockfile. web-ext pulls in another copy through fx-runner, which pins exactly 1.10.0, so this adds a scoped overrides entry for fx-runner. This is why the Dependabot update for shell-quote failed.
• source-map-js 1.2.1 -> 1.2.2 (alert chore(deps): update dependency browserslist to 4.16.5 [security] - autoclosed #179), lockfile only. This covers Bump source-map-js from 1.2.1 to 1.2.2 #331 too.
• form-data 2.3.3 -> 2.5.6 (alerts Update dependency gulp-zip to v5 #100, [v6.0.0] Filters are not Validated/Sanitized #126). It comes from svg2png -> phantomjs-prebuilt -> request@2.88.2, which pins form-data@~2.3.2 and won't get another release, so this adds a scoped override for request. 2.5 is the same major version.

Still open:

• node-forge (Bump nokogiri from 1.11.1 to 1.11.5 in /docs #177): web-ext -> @devicefarmer/adbkit. web-ext 10.7.0 and adbkit 3.3.9 are already the latest, and node-forge 1.4.0 is the latest version, so there's no fix yet.
• extract-zip (fix(deps): update dependency match-sorter to v5 #151, Option to whitelist certain tags #163), request (Update dependency gulp-ejs to v4 #87), svg2png (Version 3.1.0 #9), tough-cookie (Update Renovate Configuration #88), qs (Update dependency ansi-colors to v4 - autoclosed #104), yargs-parser (Redirect When Hiding User from Thumbnail Link #7): all come from svg2png 4.1.1 and the abandoned phantomjs-prebuilt. svg2png has no newer release, so the real fix is replacing it in scripts/generate-icons.js with something like sharp or resvg. That would clear all of these and the form-data override.
• react-router (Create Filters from Deviation Context Menu and Modal #134, Update dependency react-use to v15 #136) needs react-router-dom 7, a major upgrade. uuid (Update dependency cross-env to v7 #121) comes from @material-table/core 6.x (uuid 9); clearing it means upgrading to @material-table/core 8, which needs React 19. Neither belongs in this lockfile change.
• rubyzip in docs/Gemfile.lock (chore(deps): update dependency y18n to 4.0.1 [security] - autoclosed #169): not updated here. That needs bundle update rubyzip --conservative with Ruby, which I'll do separately.

Checked locally: npm test (lint, unit tests, Chrome/Edge/Firefox builds, manifest smoke test, zips, web-ext lint). I didn't run build:icons, since phantomjs's install script doesn't run under the current npm defaults.