Remove the temporary yarn resolutions as their parents are upgraded

Nobody has claimed this yet.

#263 adds a `resolutions` block to package.json that forces vulnerable transitives onto patched versions, because the parents that declare them (graph-cli, hardhat 2, solc, ethereum-waffle) pin ranges below the patched majors. Each entry is a workaround for one parent and should be deleted when that parent goes away. Tracking table, updated for #264:

| Resolution | Owner | Delete when |
|---|---|---|
| `**/binary-install-raw/axios`, `**/binary-install-raw/tar`, `**/ipfs-http-client/parse-duration`, `**/ipfs-core-utils/parse-duration` | graph-cli 0.69 | Removed in #264, the parents are gone under 0.98 |
| `**/apisauce/axios`, `**/ipfs-unixfs/protobufjs`, `**/jayson/uuid`, `**/tmp-promise/tmp` | graph-cli, still present under 0.98 via gluegun, kubo-rpc-client and jayson | when graph-cli updates those, check each release |
| `**/gluegun/cross-spawn`, `**/gluegun/semver`, `**/@graphprotocol/graph-cli/glob`, `**/@graphprotocol/graph-cli/undici`, `**/@graphprotocol/graph-cli/yaml` | graph-cli 0.98, added in #264 | when graph-cli bumps its own ranges past the patched versions |
| the `allow-ghsas` entry in dependency-review.yml (not a resolution) | graph-cli 0.98, see the comment on that line | when the upstream dependency is updated or dropped |
| `**/hardhat/undici`, `**/hardhat/adm-zip`, `**/hardhat/uuid` | hardhat 2 | #268 |
| `**/mocha/js-yaml`, `**/mocha/minimatch`, `**/mocha/diff`, `**/mocha/serialize-javascript` | mocha 10 pinned by hardhat | #268, a standalone mocha 11 has no old pins |
| `**/solc/tmp` | solc via hardhat and waffle | #268. solc only touches tmp in `smtsolver.js` (`tmp.fileSync`, still present in 0.2.x), which runs only with the SMT checker; this repo compiles no Solidity, so the override is safe until then. Raised on #263 by Copilot. |
| `**/request/tough-cookie`, `**/jsprim/json-schema` | request via ethereum-waffle | #268, or the waffle replacement PR |
| `**/@ethersproject/providers/ws` | ethers v5 | #268, if it moves to ethers v6 |
| same-major floors (`immutable`, `elliptic`, `lodash`, `qs`, `secp256k1`, `follow-redirects`, `nanoid`, `base-x`, `braces`, `cookie`, `ejs`, `@protobufjs/utf8`) | mixed | any time, the lockfile already holds the patched versions |

After each removal: `yarn install`, `yarn codegen`, `yarn build`, and check that the Dependabot alert count on main does not go up.

Also open: two alerts in the Security tab have no patched release upstream. Review them there and dismiss or wait as appropriate.

Start with the resolutions block in package.json and the allow-ghsas entry in dependency-review.yml, then compare each listed parent dependency with its current release and the tracking table. Remove only overrides whose parent has moved past the vulnerable range, run yarn install, yarn codegen, and yarn build, and verify that Dependabot alerts do not increase. Review the two alerts without patched releases in the Security tab.

Written by the indexing model from the issue text.