Bump direct and transitive deps to latest versions while keeping Prettier pinned at 2.8.8. Force shell-quote to 1.8.4 to resolve CVE-2026-9277 and add SECURITY.md. Co-authored-by: Cursor <cursoragent@cursor.com>