[VULN-1563] Bump undici and shell-quote for security fixes

[aaronmars]

Summary

• Bumps undici 6.25.0 -> 6.27.0 (transitive, via node-gyp), patching a WebSocket client DoS via fragment count bypass: GHSA-vxpw-j846-p89q / CVE-2026-12151.
• Bumps shell-quote 1.7.3 -> 1.9.0 (transitive, via concurrently), patching a newline-escaping vulnerability in quote()'s .op handling: GHSA-w7jw-789q-3m8p / CVE-2026-9277.
• Both packages were already declared with semver ranges (^6.25.0 and ^1.7.3 respectively) that permit the patched versions; the lockfile was just stale. Fixed via yarn up -R undici shell-quote, a lockfile-only change. No package.json edits, no overrides/resolutions needed.

Tickets

• https://appfolio.atlassian.net/browse/VULN-1563
• https://appfolio.atlassian.net/browse/VULN-1544

Test plan

• yarn install completed cleanly.
• Confirmed via yarn why undici and yarn why shell-quote that both now resolve to the patched versions.

(Supersedes #1327, which was closed because its branch name fix/VULN-1563-VULN-1544-security-deps contained a slash that breaks this repo's prerelease CI job — npm version prerelease --preid=$GITHUB_HEAD_REF-<sha> fails on any branch name containing /.)

[github-actions]

Released prerelease version 8.19.6-VULN-1563-VULN-1544-security-deps-34cee73.0.
You may now run npm install @appfolio/react-gears@VULN-1563-VULN-1544-security-deps