🔒️ Fix remaining Dependabot alerts (scripts deps + vendored mermaid) (#3045)

* 📌 Bump vendored mermaid to 11.16.1

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* 🔒️ Fix vulnerable transitive deps in scripts

Refresh brace-expansion to 2.1.4 and protobufjs to 7.6.5, and override
uuid to 11.1.1 to clear the remaining Dependabot alerts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

scripts/package.json

@@ -11,5 +11,8 @@
   "dependencies": {
     "csv-parse": "~7.0.0",
     "firebase-admin": "^14.1.0"
+  },
+  "overrides": {
+    "uuid": "^11.1.1"
   }
 }