fix(security): bump postcss pin from 8.5.12 to 8.5.23

Bumps the repo-wide postcss override/resolution from 8.5.12 to
8.5.23 to remediate GHSA-r28c-9q8g-f849 (CVSS 7.5, High).

The advisory describes a path-traversal bug in PostCSS's
sourceMappingURL auto-loading (lib/previous-map.js): a crafted
sourceMappingURL containing ../ sequences could read arbitrary .map
files from the filesystem. The fix in 8.5.18+ restricts source-map
loading to the opts.from directory; 8.5.18 through 8.5.23 contain no
further breaking changes.

postcss is not a direct dependency of BitGoJS; it is pulled in
transitively by css-loader, sanitize-html, @vue/compiler-sfc, and the
web-demo app. Because the existing resolutions/overrides pin was
already collapsing all four ranges (^8.2.14, ^8.2.15, ^8.3.11,
^8.5.6) to a single version, switching to 8.5.23 satisfies every
range unchanged. None of BitGoJS's usages load source maps from
outside opts.from, so the new restriction has no functional impact.

This unblocks the "Publish @bitgo-beta" GitHub Actions workflow, which
was failing at the osv-scanner "Enforce Vulnerability Severity
Threshold" gate due to this advisory.

Ticket: INF-2186
Session-Id: 87e939d9-34b0-414f-9c42-0dbca6398ab4
Task-Id: da7773f3-f9b6-44b0-b5df-ce432cca3a78

Author: Support Bot

package.json

@@ -129,7 +129,7 @@
     "sjcl": "npm:@bitgo/sjcl@1.0.1",
     "picomatch": ">=2.3.2",
     "fast-uri": "3.1.3",
-    "postcss": "8.5.12",
+    "postcss": "8.5.23",
     "@babel/plugin-transform-modules-systemjs": "7.29.4",
     "protobufjs": "7.6.4",
     "@protobufjs/fetch": "1.1.0",
@@ -201,7 +201,7 @@
     "sjcl": "npm:@bitgo/sjcl@1.0.1",
     "picomatch": ">=2.3.2",
     "fast-uri": "3.1.3",
-    "postcss": "8.5.12",
+    "postcss": "8.5.23",
     "@babel/plugin-transform-modules-systemjs": "7.29.4",
     "protobufjs": "7.6.4",
     "@protobufjs/fetch": "1.1.0",

yarn.lock

@@ -17313,10 +17313,10 @@ postcss-value-parser@^4.0.2, postcss-value-parser@^4.1.0, postcss-value-parser@^
   resolved "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz"
   integrity sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==
 
-postcss@8.5.12, postcss@^8.2.14, postcss@^8.2.15, postcss@^8.3.11, postcss@^8.5.6:
-  version "8.5.12"
-  resolved "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz#cd0c0f667f7cb0521e2313234ea6e707a9ec1ddb"
-  integrity sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==
+postcss@8.5.23, postcss@^8.2.14, postcss@^8.2.15, postcss@^8.3.11, postcss@^8.5.6:
+  version "8.5.23"
+  resolved "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz"
+  integrity sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==
   dependencies:
     nanoid "^3.3.11"
     picocolors "^1.1.1"