EUREKA-884: Bump ajv from 6.17/8.17 to 8.20.0 fix CVE-2025-69873

[julianladisch]

https://folio-org.atlassian.net/browse/EUREKA-884

Sunflower CSP fix for R1-2025-okapi branch.

How to do:

• In yarn.lock delete the ajv@^8.0.0, ajv@^8.9.0: version "8.17.1" entry.
• In yarn.lock delete the webpack@^5.80.0: version "5.97.1" entry that contains the schema-utils "^3.2.0" dependency that requires ajv 6.
• Run yarn to update yarn.lock.
• This will result in webpack 5.107.0 with schema-utils 4 dependency.
• This will result in ajv 6 be removed.
• This will result in ajv 8 be bumped to fixed 8.20.0.

This will fix the security vulnerability:

• GHSA-2g4f-4pwh-qvx6 - CVE-2025-69873 - ajv - Regular Expression Denial of Service (ReDoS) – The security vulnerability is only exploitable if the $data option is enabled.

FOLIO Security Team requests this as Sunflower CSP fix.

[zburke]

@julianladisch, @wafschneider:
A little history:

1. #3593 directly bumped the versions of lodash (4.17.21 to 4.18.1) and stripes-build (1.0.0 to 1.1.1; STRWEB-155), and as a side-effect bumped the versions of many many other packages. We made a parallel change in platform-lsp#R1-2025.
2. #3603 consolidated and bumped the version of ajv, same as this PR.
3. #3610 reverted the stripes-build version-bump from #3593 to resolve a UI glitch, but as a side-effect reintroduced many of the security issues resolved there, among them sharp's post-install lifecycle script and this ajv issue.
4. This PR restores the ajv update but leaves those other security issues unaddressed.

We can proceed with this PR, but I'm not sure it's our best option. The scope here is narrow; it resolves the ajv issue, but leaves open many other security issues that will need to be (re)addressed.

The UI glitch notwithstanding, I wonder if a better approach would be to revert #3610 to put us back on solid footing with respect to security, while simultaneously investigating a more surgical approach to address the UI issue that has been introduced. It appears likely that the transitive changes necessary to address this ajv vulnerability are a direct cause of this UI glitch. Is it worth reevaluating the value of that security fix given these side-effects?

CC: @JohnC-80, the UI glitch is extra margin around the pill-buttons in applications like ui-inventory (see below). Wayne asked us about this in Slack earlier in the week. Does this ring any bells for you?