chore(security): bump transitive node-tar to >=7.5.11 (clear 6 high advisories) (#1498)

`sqlite3` (an optional peer driver in `driver-sql`, build script pnpm-ignored)
pulled `tar@6.2.1` via its node-gyp toolchain, tripping 6 high-severity
node-tar path-traversal/symlink advisories — which failed the
`pnpm audit --audit-level=high` "Validate Dependencies" gate.

Adds a scoped pnpm override `"tar@>=2.0.0 <7.5.11": "^7.5.11"` so every
vulnerable node-tar resolves to a patched 7.5.x+ (the ancient unrelated
`tar@1.1.11` line is deliberately excluded by the `>=2.0.0` lower bound).

Verified: `pnpm audit --audit-level=high` → exit 0 (0 high / 0 critical;
2 low + 5 moderate remain, below the gate); `pnpm install --frozen-lockfile`
clean; `@objectstack/driver-sql` build + 132 tests pass.

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

.changeset/audit-tar-override.md

@@ -0,0 +1,4 @@
+---
+---
+
+chore(security): override transitive `node-tar` to `>=7.5.11`, clearing 6 high-severity advisories (GHSA-34x7-hfp2-rc4v, -8qq5-rm4j-mr97, -83g3-92jg-28cx, -qffp-2rhf-9h96, -9ppj-qmqm-q256, -r6q2-hw4h-h46w) that failed the Validate Dependencies gate. Lockfile-only; no published package code change.

package.json

@@ -47,7 +47,8 @@
   "packageManager": "pnpm@10.31.0+sha512.e3927388bfaa8078ceb79b748ffc1e8274e84d75163e67bc22e06c0d3aed43dd153151cbf11d7f8301ff4acb98c68bdc5cadf6989532801ffafe3b3e4a63c268",
   "pnpm": {
     "overrides": {
-      "minimatch@<10.2.3": "10.2.3"
+      "minimatch@<10.2.3": "10.2.3",
+      "tar@>=2.0.0 <7.5.11": "^7.5.11"
     },
     "ignoredBuiltDependencies": [
       "@nestjs/core",