UNOMI-875: Post-3.1 npm hygiene (wab + graphql-ui Dependabot batch)

[sergehuber]

Plain-language summary

After the main 3.1 platform PR merged, several small security updates were still open for the web tracker and GraphQL UI front-end builds. Those modules are build-time only and do not change Unomi runtime behavior.

This PR applies them in one batch so we do not run five separate full integration test cycles for tiny yarn lockfile changes.

What changed

• web-tracker wab: bump rollup to 2.80.0; pin transitive minimatch, picomatch, @babel/runtime, and serialize-javascript via yarn resolutions
• graphql-ui: bump webpack to 5.104+ (resolves to 5.108.x)
• Refresh both yarn.lock files; no Java or Karaf changes

Dependabot follow-up (after merge)

• Comment @dependabot rebase on Bump webpack from 5.92.1 to 5.104.1 in /graphql/graphql-ui #813–Bump picomatch from 2.3.1 to 2.3.2 in /extensions/web-tracker/wab #817 so they auto-close
• Keep Bump log4j.version from 2.24.0 to 2.26.1 #799, Bump com.opencsv:opencsv from 3.10 to 5.12.0 #800, Bump comet-java-client.version from 5.0.13 to 9.0.1 #801 closed/deferred to 3.2 (log4j, opencsv, comet majors)

Test plan

• yarn build in extensions/web-tracker/wab
• yarn build:production in graphql/graphql-ui
• mvn -pl extensions/web-tracker/wab,graphql/graphql-ui,wab -am package -DskipTests
• CI unit tests
• CI ES + OS integration tests

References

UNOMI-875 (optional post-3.1 hygiene); supersedes Dependabot #813, #814, #815, #816, #817