Security update for agama-web-ui

Open Source Vulnerabilities openSUSE-SU-2026:21448-1

This update for agama-web-ui fixes the following issues: - CVE-2025-7783: form-data: unsafe `Math.random()` function is used to select a boundary value for multipart form-encoded data (bsc#1246822). - CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames (bsc#1272310). - CVE-2026-13149: brace-expansion: `expand()` function exhibits exponential-time complexity when processing non-expanding `{}` brace groups (bsc#1269927). - CVE-2026-13311: shell-quote: quadratic complexity in `parse()` function when processing specially crafted strings (bsc#1269359). - CVE-2026-13676: fast-uri: host-based policy bypass due to failure to canonicalize Unicode/IDN hostnames for HTTP-family URLs (bsc#1269595). - CVE-2026-27601: underscore: DoS via stack overflow due to missing depth limits in `_.flatten` and `_.isEqual` functions (bsc#1259169). - CVE-2026-40181: react-router: open redirect to an external domain due to path values starting with `//` being reinterpreted as protocol-relative URLs (bsc#1272311). - CVE-2026-49356: @babel/core: arbitrary file read via `sourceMappingURL` comment (bsc#1272317). - CVE-2026-53550: js-yaml: quadratic complexity in merge-key processing when processing a crafted YAML document (bsc#1268851). - CVE-2026-53632: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows (bsc#1272319). - CVE-2026-54466: websocket-driver: message corruption via abuse of protocol length headers (bsc#1272312). - CVE-2026-54490: websocket-driver: resource limit bypass via message compression (bsc#1272313). - CVE-2026-55602: http-proxy-middleware: Host-header-driven backend routing bypass via `router` host+path substring matching (bsc#1272318).