fix: Resolve uuid to ^11.1.1 to patch CVE-2026-41907 (#12541)

Forces transitive uuid copies (8.3.2 via sequelize/bull, 9.0.1 via
@hocuspocus/*) onto the patched 11.1.1, addressing GHSA-w5hq-g745-h8pq.
11.1.1 is the highest version that is both patched and ships a CommonJS
build, which the require()-based consumers depend on.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

package.json

@@ -388,7 +388,8 @@
     "minimatch@npm:9.0.1": "9.0.9",
     "lodash@npm:4.17.21": "^4.18.1",
     "i18next-parser/i18next": "^23.16.8",
-    "ws@npm:~8.17.1": "^8.20.1"
+    "ws@npm:~8.17.1": "^8.20.1",
+    "uuid": "^11.1.1"
   },
   "version": "1.7.1",
   "packageManager": "yarn@4.11.0"