fix: bump fflate to 0.8.3 and toml to 4.3.0 (osv-scanner CVSS 7.0+ gate)

[ArunBala-Bitgo]

Summary

The release's osv-scanner "Enforce Vulnerability Severity Threshold" gate was failing on 3 advisory groups at CVSS >= 7.0:

• fflate@0.8.2 (transitive via @bitgo/key-card > jspdf) — GHSA-px8p-9vwx-vf98 (CVSS 7.5): unzipSync can infinite-loop on a malformed ZIP64 archive.
• toml@2.3.6 (transitive via bitgo > stellar-sdk) — GHSA-82x6-q7mm-w9cf (CVSS 7.5): uncontrolled recursion DoS in toml.parse().
• toml@2.3.6 — GHSA-v5mp-jgw5-2x6j (CVSS 8.2): prototype pollution via __proto__ key-path desync in toml.parse().

Fixed by pinning both via root resolutions:

• fflate -> 0.8.3 (patch release with the fix)
• toml -> 4.3.0 (latest 4.x, includes both fixes)

Verification

• Full monorepo yarn install + build succeeded with both pins in place.
• jspdf only calls fflate.zlibSync (compression) — never unzipSync — so the bump carries no behavioral risk there.
• stellar-sdk's toml.parse() call shape (require("toml").default.parse(text)) is unchanged in 4.3.0 (still CJS, main: index.js); confirmed with a standalone parse test.
• We also checked whether our code ever reaches stellar-sdk's toml-based domain resolution path (StellarTomlResolver/FederationServer.createForDomain) — we don't; our XLM federation lookups use a fixed BitGo URL — but bumping to the patched version was safer/cleaner than an exclusion here since it verified cleanly, unlike tar's exclusion-only case elsewhere in osv-scanner.toml.

Test plan

• yarn install succeeds, full monorepo build succeeds
• fflate resolves to 0.8.3, toml resolves to 4.3.0 (yarn why)
• CI passes
• osv-scanner "Enforce Vulnerability Severity Threshold" step passes on next run

[linear-code]

CECHO-2099