[aikido-autofix]

What does this PR do?

Upgrade pa11y-ci to fix arbitrary file read/write vulnerability in zip extraction via unvalidated symlink targets.

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-56876	HIGH	[extract-zip] Improper symlink target validation allows attackers to create symlinks pointing outside the extraction directory, enabling arbitrary file read/write access through malicious zip archives.

How did you verify your code works?

[github-actions]

Coverage after merging fix/aikido-security-update-packages-154905241-cfpg into main will be

96.55%

Coverage Report

File	Stmts	Branches	Funcs	Lines	Uncovered Lines
src
aggregate.ts	100%	100%	100%	100%
api-utils.ts	92.80%	100%	91.67%	92.92%	101–103, 165, 86–87, 92–93
api.ts	94.96%	100%	100%	94.42%	340–343, 405, 422, 53, 64–67, 69
cache.ts	94.37%	100%	100%	93.94%	139–141, 39
completions.ts	99.44%	100%	100%	99.39%	268
gh-cli.ts	100%	100%	100%	100%
group.ts	98.37%	100%	98.33%	98.37%	1105, 263–265, 525, 531, 607, 865, 980
output.ts	99.31%	100%	95.83%	99.62%	89
regex.ts	99.37%	100%	100%	99.32%	360
render.ts	90.35%	100%	88.24%	90.43%	175, 177–178, 201–206, 208–210, 213, 234–235, 427–428, 528–532, 562–569, 571–579, 582–584
scroll-cooldown.ts	100%	100%	100%	100%
style.ts	100%	100%	100%	100%
upgrade.ts	86.73%	100%	92.31%	86.36%	128, 131, 133–134, 153–154, 167–169, 188–193, 195, 198–202, 209, 214, 250–253
src/render
filter-match.ts	97.22%	100%	92.31%	100%
filter.ts	100%	100%	100%	100%
highlight.ts	96.53%	100%	90.40%	99.28%	284–285
layout-constants.ts	100%	100%	100%	100%
mouse-hit.ts	100%	100%	100%	100%
mouse.ts	100%	100%	100%	100%
rows.ts	99.34%	100%	100%	99.29%	239
selection.ts	100%	100%	100%	100%
summary.ts	100%	100%	100%	100%
team-pick.ts	100%	100%	100%	100%
terminal.ts	100%	100%	100%	100%