feat(investigate): add yarn (and pnpm) remediation path — currently npm-only

BLEnder's alert remediation only knows npm. JS alerts (Dependabot ecosystem npm_and_yarn) are mapped to npm (ECOSYSTEM_MAP in automerge_dependabot.py) and routed to action=npm_bump, whose only mechanism is:

npm audit fix --package-lock-only

That rewrites package-lock.json. yarn/pnpm repos don't have one, so on those repos remediation does nothing.

Since #119, the step skips gracefully instead of erroring (no more re-investigation loop) — but "skip" means the alert is never actually fixed. So on a yarn repo like mozilla/fxa, BLEnder can investigate, dismiss unaffected low/medium, and open advisories for affected alerts, but it cannot bump a yarn dependency.

Feature request

A yarn remediation path parallel to the existing npm and pip paths:

• direct deps: bump in package.json + regenerate yarn.lock
• transitive deps: resolutions (yarn) / overrides override + lockfile regen
• ideally pnpm too (pnpm.overrides)

Detect the package manager from the lockfile present and dispatch accordingly.

Read automerge_dependabot.py, especially ECOSYSTEM_MAP and the action=npm_bump path, and trace how the existing npm and pip remediation paths dispatch. Done means detecting the lockfile package manager, supporting yarn direct and transitive remediation with lockfile regeneration, and adding pnpm overrides where supported; the issue names no tests to run.