fix: pin form-data >=4.0.6 to patch CRLF injection

[angelocordon]

Summary

Adds a pnpm.overrides entry to force form-data to >=4.0.6, resolving a CRLF injection vulnerability in all resolved instances of the package.

• Advisory: GHSA-hmw2-7cc7-3qxx
• Jira: SECVULN-46679

Root cause

form-data through v4.0.5 concatenated the field name and filename option directly into the Content-Disposition header with no escaping of \r, \n, or ". An application passing untrusted input as a field name or filename could allow an attacker to inject headers or smuggle additional multipart parts. Fixed in form-data@4.0.6 by percent-encoding those characters, matching the WHATWG HTML multipart/form-data encoding algorithm.

Transitive dependency chain

@openapitools/openapi-generator-cli
  └─ @nestjs/axios
       └─ axios
            └─ form-data 4.0.5 (vulnerable) → 4.0.6 (patched) ✅

Why pnpm.overrides is necessary

form-data is two hops deep under axios, which is itself a transitive dependency. Upgrading @openapitools/openapi-generator-cli (done in the base PR #64) did not change the axios version or its form-data specifier. There is no direct dependency to upgrade through; pnpm.overrides is the pnpm-idiomatic mechanism for exactly this scenario.

Scope

This repo never imports form-data directly — it is only present as a transitive dev dependency. There is no production exposure.

Stacked on

This PR is stacked on top of #64. Once #64 merges, this PR's base can be retargeted to main and the diff will show only the pnpm.overrides addition.

Files changed

• package.json — adds pnpm.overrides block (3 lines)
• pnpm-lock.yaml — regenerated; form-data@4.0.5 replaced by form-data@4.0.6 throughout

Revert plan

Reverting this PR fully restores the previous state. No database migrations, feature flags, or infrastructure changes are involved.

---

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

• If applicable, I've documented the impact of any changes to security controls.

  This PR is a security control improvement: it pins a transitive dev dependency to its patched version, eliminating a known CRLF injection vulnerability (GHSA-hmw2-7cc7-3qxx / SECVULN-46679) from the dependency graph.

[hashicorp-cla-app]

All committers have signed the CLA.