fix(security): clear post-merge OSV advisories

New advisories landed after the integration work: fast-uri (High) and hono
(3x Medium) picked up fixed releases, and a Medium surfaced on
@hono/node-server. Bump the fast-uri and hono override pins to their fixed
patch releases (3.1.3, 4.12.27), clearing four findings.

The remaining @hono/node-server advisory is reachable only through the unused
@modelcontextprotocol/sdk transitive (no source imports it, no Hono server is
started); its only fix is a major bump the SDK pins against. Record that
assessment in .osv-scanner.toml so the scheduled scan stays honest instead of
alarming on an unreachable path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

package.json

@@ -84,8 +84,8 @@
   "overrides": {
     "@protobufjs/utf8": "1.1.1",
     "adm-zip": "0.6.0",
-    "fast-uri": "3.1.2",
-    "hono": "4.12.25",
+    "fast-uri": "3.1.3",
+    "hono": "4.12.27",
     "ip-address": "10.2.0",
     "protobufjs": "7.6.5",
     "qs": "6.15.2"