chore(builder-app): consolidate 9 dependabot security updates for react template

Merges PRs #5671, #5670, #5669, #5667, #5657, #5652, #5647, #5641, #5592.
Pins transitive deps ws, postcss, axios, js-yaml, websocket-driver via overrides
to resolve security vulnerabilities that could not be updated directly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: tzuge