fix: resolve PostCSS OSV vulnerability

[Leexunhuan743]

Summary

• Raise the declared PostCSS version from ^8.5.16 to the patched ^8.5.18 range for GHSA-r28c-9q8g-f849.
• Refresh package-lock.json, resolving PostCSS to 8.5.23 and its required Nano ID dependency to 3.3.16.
• Replace the pnpm audit job—which always skipped because this repository has no pnpm-lock.yaml—with npm audit --audit-level=high against the existing npm lockfile.

Change Type

• Bug fix
• Feature
• Compatibility update
• Documentation
• Refactor

Cross-File Checklist

• I read CONTRIBUTING.md.
• Schema changes, if any, updated both runtime schema and migrations/0001_init.sql (no schema changes).
• Persistent data changes, if any, updated backup export/import or documented why backup is not needed (no persistent data changes).
• User-facing text changes, if any, updated all locale files (no user-facing text changes).
• Bitwarden client compatibility was considered for sync/API shape changes (no sync/API shape changes).
• No secrets, tokens, private deployment values, or real vault data are included.

Checks

• npx tsc -p tsconfig.json --noEmit
• npx tsc -p webapp/tsconfig.json --noEmit (fails with the same four pre-existing errors on base commit 8e5d9e2; see Notes)
• npm run i18n:validate
• npm run build
• npm audit --audit-level=high (0 vulnerabilities)
• OSV, CodeQL, Semgrep, Gitleaks, actionlint, and zizmor workflows pass on the head commit.

Notes

The webapp TypeScript check fails identically on both this branch and the base commit in the following unchanged files:

• webapp/src/lib/api/backup.ts
• webapp/src/lib/backup-center.ts
• webapp/src/lib/password-security-cache.ts
• webapp/vite.config.ts

This PR changes only dependency metadata and the matching dependency-audit workflow; it does not modify runtime or webapp source code.