chore: remediate vulnerable transitive dependencies

Problem

The repository currently pins or resolves several vulnerable transitive
dependencies even though patched versions are available within the existing
dependency majors. The open Nx Dependabot PR updates only nx, while the
repository keeps the rest of the @nx/* family at 22.1.3.

Related existing work:

• #666 updates only nx from 22.1.3 to 22.7.7 and does not align the complete
  Nx package family.
• #604 targets Nx 22.3, is conflicting, and is below the desired 22.7.7 floor.

Requested change

Create one focused dependency-security PR from current main:

1. Align nx and every direct @nx/* dependency in the root package.json
   from 22.1.3 to 22.7.7.
2. Raise the root axios resolution from ^1.12.0 to at least ^1.16.0.
3. Raise the root node-forge resolution from 1.3.2 to 1.4.0.
4. Refresh and deduplicate yarn.lock so compatible transitive dependencies
   resolve at or above these patched floors:
   • tar 7.5.22
   • minimatch 3.1.4, 5.1.8, and 10.2.3 as applicable
   • @babel/plugin-transform-modules-systemjs 7.29.4
   • @isaacs/brace-expansion 5.0.1
   • brace-expansion 1.1.18 and 2.1.4
   • browserslist 4.28.7
   • form-data 4.0.6
   • ip-address 10.3.1
   • js-yaml 3.15.1
   • nanoid 3.3.18
   • picomatch 4.0.4
   • postcss 8.5.18
   • rollup 4.59.0
   • tmp 0.2.6
   • vite 6.4.3
5. Apply an Nx migration file only if the Nx migration command generates a
   necessary repository change.

Keep the change limited to dependency remediation. Do not introduce unrelated
toolchain or application refactors.

Acceptance criteria

• The root manifest uses one consistent 22.7.7 version for nx and all direct
  @nx/* dependencies.
• yarn.lock no longer resolves the vulnerable versions replaced above.
• yarn dedupe --check passes.
• Existing repository lint, type-check, unit, and representative React
  17/18/19 validation used by CI pass.
• The pull request explains any dependency that cannot reach the requested
  patched floor.
• The pull request states whether it supersedes #666; do not leave two
  overlapping dependency PRs intended to merge.

Notes

Current main no longer contains react-router 7.0.0 in manifests or
yarn.lock. Do not add a code change for that package unless a current
dependency path is found.

Start with the root package.json and compare its nx/@nx/*, axios, and node-forge resolutions against the requested floors, then inspect yarn.lock for the listed vulnerable transitive versions. Refresh the lockfile without unrelated changes, run yarn dedupe --check, and run the repository lint, type-check, unit, and representative React 17/18/19 validation used by CI.