fix(deps): override uuid to ^11.1.1 (Dependabot #85) (#3418)

uuid <11.1.1 has a missing buffer-bounds check in v3/v5/v6 when a buffer
arg is passed (GHSA, medium). Vulnerable copies were uuid@8.3.2 (via exceljs
in @trycompai/api — prod-reachable) and uuid@9.0.1 (via @trigger.dev/sdk).
Add a flat override to ^11.1.1: uuid's v1/v3/v4/v5 named API is stable across
these majors and v11 keeps a dual CJS/ESM build, so exceljs / @azure/core-http
/ @trigger.dev/sdk remain drop-in compatible. Caret stays in 11.x (12.0.0 is
still vulnerable). Resolves to a single uuid@11.1.1.

Verified: turbo build 20/20; bun audit 15 -> 14 (uuid cleared).

The other 7 open bun.lock alerts (minimatch x3, esbuild x2, cookie,
@ai-sdk/provider-utils) have no safe published fix and are not
prod-runtime-reachable -> handled via dismiss-with-rationale, not overrides.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: Marfuen

bun.lock

@@ -127,6 +127,7 @@
     "@sigstore/core": "3.2.1",
     "markdown-it": "^14.3.0",
     "@babel/core": "^7.29.7",
+    "uuid": "^11.1.1",
     "@tiptap/core": "3.22.1",
     "@tiptap/extension-blockquote": "3.22.1",
     "@tiptap/extension-bold": "3.22.1",