chore(deps): update vulnerable packages to patched versions

Updated packages:
- simple-git 3.32.3 → 3.36.0 (RCE vulnerability)
- fast-uri 3.1.0 → 3.1.2 (host confusion, path traversal)
- dompurify 3.3.1 → 3.4.5 (XSS bypasses)
- mermaid 11.13.0 → 11.15.0 (CSS injection, DoS)
- uuid 11.1.0 → 11.1.1 (buffer bounds check)
- ws 8.20.0 → 8.20.0 (uninitialized memory)
- ip-address 10.1.0 → 10.2.0 (XSS)
- @xmldom/xmldom 0.8.11 → 0.9.10 (XML injection, DoS)
- docx4js 3.3.0 → 2.0.1 (breaks xml2js dep chain)
- brace-expansion (transitive update)

Also applied lint:fix autofix (const correctness).

Amit Haridas

src/main/PDFOperations.js

@@ -60,13 +60,13 @@ async function pdfSplit(data) {
     const pdf = await PDFDocument.load(pdfBytes);
     const totalPages = pdf.getPageCount();
 
-    let splits = [];
+    const splits = [];
 
     if (data.splitMode === 'pages') {
       const ranges = data.pageRanges.split(',').map(r => r.trim());
       for (let i = 0; i < ranges.length; i++) {
         const range = ranges[i];
-        let pages = [];
+        const pages = [];
 
         if (range.includes('-')) {
           const [start, end] = range.split('-').map(n => parseInt(n.trim()));