[Crypto2099]

Updates form-data from 4.0.5 to 4.0.6 for GHSA-hmw2-7cc7-3qxx (CRLF injection through unescaped multipart field names and filenames, affects >= 4.0.0, < 4.0.6; Dependabot alert https://github.com/input-output-hk/daedalus/security/dependabot/512). form-data is a runtime dependency.

Updates body-parser from 1.20.8 to 1.20.9 for GHSA-27r3-jxmh-p828 (denial of service through trailing bytes after a compressed request body, patched in 1.20.9). It is reached through express from @storybook/* and webpack-dev-server, so it is a development dependency.

package.json pins the form-data dependency to 4.0.6 and raises the **/**/form-data resolution from the exact 4.0.5 to ^4.0.6. The resolution is kept so that dependents asking for ^3.0.0 or ^4.0.4 are still forced onto 4.x. yarn.lock now has one form-data entry for all four descriptors (4.0.6, ^3.0.0, ^4.0.4 and ^4.0.6), and it resolves 4.0.6, outside the vulnerable range.

yarn.lock resolves body-parser@~1.20.5 to 1.20.9. Beyond the two packages, the lockfile moves hasown and mime-types ranges requested by form-data 4.0.6 (both already resolved to the required versions).

tests/common/unit/dependency-security.spec.ts gains a case that appends a field name and filename containing CR, LF and quotes and checks that no injected header line appears in the multipart body.

Closes #3435