chore(deps): override form-data to 4.0.6 (#441)

* chore(deps): override form-data to 4.0.6

Resolves GHSA-7m2j-8qp9-m8jw (CRLF injection) by forcing transitive form-data to 4.0.6 via pnpm override.

* chore(deps): move pnpm config to pnpm-workspace.yaml

pnpm 10 reads overrides and onlyBuiltDependencies from pnpm-workspace.yaml instead of package.json.

Author: humble-little-bear

package.json

@@ -25,11 +25,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "secp256k1"
-    ]
-  },
   "scripts": {
     "build": "node scripts/build.js",
     "start": "ts-node-dev --transpile-only src/cli.ts",

pnpm-lock.yaml

@@ -0,0 +1,5 @@
+overrides:
+  "form-data@>=4.0.0 <4.0.6": "4.0.6"
+
+onlyBuiltDependencies:
+  - secp256k1