ci: patch the Vercel CLI's vulnerable dependencies (#11000)

This PR clears the 51 Dependabot alerts on
`.github/vercel-cli/package-lock.json`. `npm audit` goes from 33
advisories to 0.

`vercel@64.0.2` pins vulnerable versions of tar, undici, js-yaml,
minimatch, path-to-regexp, smol-toml, ajv and zod. One tar advisory is
critical. undici has a TLS validation bypass, and the deploy token goes
through undici. `vercel@65.0.0` pins the same versions.

npm `overrides` set each library to a fixed release past the 7-day
cooldown. Only undici 5 changes major, to 6.29.1.

I made a real preview deploy with the patched CLI and the workflow
flags. It worked.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Signed-off-by: Will Manning <will@willmanning.io>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: lwwmanning