Pin follow-redirects to 1.16.1 for two high advisories

docs/DEPENDENCIES.md

@@ -25,6 +25,7 @@ Dependencies are added deliberately as part of normal development, via `npm inst
   - `node-gyp`'s `undici` dependency is bumped to `^6.29.0` to patch [CVE-2026-85024](https://github.com/advisories/GHSA-3wwx-pv8p-q78v) (affecting `6.25.0`–`6.28.0`). Scoped to `node-gyp` (reached via the dev-only `@lizenz/checker`) because the app's own direct `undici` dependency already carries the same fix on the 8.x line (8.10.2). Needed because `node-gyp` declares `undici: ^6.25.0`.
   - `eslint-plugin-react`'s `eslint` dependency is bumped to `^10.9.1` to allow ESLint v10 support. Needed because `eslint-plugin-react@7.37.2` officially supports only up to `eslint@^9.7`, but the linting rules in ESLint v10 are stricter and require updating the codebase to comply. This override is temporary — once `eslint-plugin-react` releases a new major version with official ESLint v10 support, it can be removed.
   - `fast-copy: ^4.1.0` patches [GHSA-jggr-w7fw-pc2j](https://github.com/advisories/GHSA-jggr-w7fw-pc2j) (stack exhaustion when copying deeply nested values, fixed in 4.1.0). Dev-only. Needed because `pino-pretty` declares `fast-copy: ^4.0.0`, which still allows the unpatched 4.0.0–4.0.4.
+  - `follow-redirects: ^1.16.1` patches [GHSA-q3jh-wrc6-jgq8](https://github.com/advisories/GHSA-q3jh-wrc6-jgq8) (array-form headers bypass cross-origin credential stripping) and [GHSA-8r9p-f939-6h3c](https://github.com/advisories/GHSA-8r9p-f939-6h3c) (`sensitiveHeaders` regex escaping can expose credential headers), both affecting `1.16.0`. Needed because `axios` declares `follow-redirects: ^1.16.0`, which still permits the vulnerable release.
   - `postcss-selector-parser: ^7.1.6` patches [CVE-2026-104844](https://github.com/advisories/GHSA-rj75-hqrm-r3gf) (quadratic complexity in flat selector parsing, fixed in 7.1.6). Dev-only. Needed because `@npmcli/query` declares `postcss-selector-parser: ^7.0.0`. The 6.x line has no fix; its only consumer, the unused `@tailwindcss/typography`, was removed rather than forced across a major version.
   - All of the above should be revisited (and likely removed) once the upstream packages bump their own internal dependency ranges past the vulnerable versions.
   - The `check-overrides` CI job (`npm run check:overrides`, see [`scripts/check-overrides.mjs`](https://github.com/Doezer/Questarr/blob/main/scripts/check-overrides.mjs)) checks this automatically on every PR and fails once an override is no longer needed, so there's no need to track removal manually.

package.json

@@ -225,6 +225,7 @@
       "eslint": "^10.9.1"
     },
     "fast-copy": "^4.1.0",
+    "follow-redirects": "^1.16.1",
     "postcss-selector-parser": "^7.1.6"
   },
   "allowScripts": {