fix: update browserslist to resolve CVE-2026-73088

[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln — test to make sure that nothing is broken, check compatibility, etc.

Updated transitive dev-dependency browserslist (pulled in via webpack) to a patched version via an npm overrides entry.

• Dependency: browserslist updated to 4.28.9 (>= patched 4.28.7)
• Advisory: GHSA-73wf-gq98-2v4g (CVE-2026-73088)
• Dependabot alert: https://github.com/warpdotdev/workflows/security/dependabot/40
• Verification: npm install in build_ts/ ran the prepare/build scripts (tsc + webpack) successfully; npm audit no longer reports browserslist.

Highlight the risky code / where the dependency was used

build_ts/package.json / build_ts/package-lock.json only — browserslist is a dev-only transitive dependency of webpack, not used in runtime workflow code.

Special instructions for this PR — e.g. if it's a Stainless thing

None.

AFTER YOU MERGE

None.