fix(deps): remove .snyk ignore policy, actually fix eslint/js-yaml CVEs

The .snyk file suppressed issues instead of fixing them and shouldn't
have been committed. Force real fixes via overrides on gatsby's nested
eslint (7.32.0 -> 9.26.0), js-yaml (3.15.0 -> ^4.2.0), and the
resulting @eslint/plugin-kit ReDoS pulled in by the eslint bump
(-> ^0.3.4). Verified with build + jest suite that gatsby's bundled
webpack/eslint-loader still works with eslint 9 forced underneath it.

react-dev-utils's critical command-injection (SNYK-JS-REACTDEVUTILS-17890708)
is left unresolved on purpose: Snyk reports no fixed or patchable version
exists (semver vulnerable: '*'), and it lives inside gatsby's own
peerDependency tree, not anything this plugin ships. The license-policy
flags on axe-core/sharp-libvips are not vulnerabilities and have no code
fix. Both are left visible in scans rather than hidden behind an ignore
file.

Author: abhishek-ezhava-cstk