chore(security): resolve flagged Scorecard + Dependabot alerts

- graph-ui: bump vite ^6.4.2 -> ^6.4.3 and add overrides pinning the transitive
  form-data >=4.0.6 and @babel/core >=7.29.6 (all dev-scope build/test deps, not
  shipped in the binary). Clears the 4 open Dependabot alerts and Scorecard's
  VulnerabilitiesID. `npm audit` now reports 0 vulnerabilities.
- codeql.yml: move `security-events: write` from the workflow top level to the
  `analyze` job (top level is now `contents: read`), resolving Scorecard's
  TokenPermissionsID least-privilege finding. CodeQL still uploads results from the
  job-scoped token.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

.github/workflows/codeql.yml

@@ -7,7 +7,6 @@ on:
     branches: [main]
 
 permissions:
-  security-events: write
   contents: read
 
 concurrency:
@@ -17,6 +16,12 @@ concurrency:
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    # CodeQL needs security-events: write to upload results; scoped to this job so
+    # the workflow's top-level token stays read-only (Scorecard TokenPermissions).
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3