[MINOR] Bump zeppelin-react linkify-it and undici to clear high npm-audit advisories

[voidmatcha]

What is this PR for?

npm audit --audit-level=high fails on master, so every frontend PR's npm-audit job goes red. Two high-severity advisories in zeppelin-react's dependency tree:

• linkify-it 3.0.3 (via ansi-to-react): GHSA-22p9-wv53-3rq4. Constrained to ^5.0.2.
• undici 7.27.0 (via jsdom): GHSA-vmh5-mc38-953g and related. Constrained to ^7.28.0, which stays within jsdom's ^7.25.0 and lets in-range security patches flow.

Both use overrides. npm audit fix --force was avoided because it downgrades ansi-to-react.

The linkify-it 3 to 5 bump needs no source changes. No project code imports linkify-it, and its only consumer (ansi-to-react) calls .tlds(), .pretest(), and .match(), which are unchanged from v3 through v5. The override deliberately crosses ansi-to-react's declared ^3.0.3 range, and can be revisited if ansi-to-react is updated.

What type of PR is it?

Improvement

What is the Jira issue?

N/A

How should this be tested?

• cd zeppelin-web-angular/projects/zeppelin-react && npm ci && npm audit --audit-level=high exits 0.
• npm run lint, npm test (vitest), and npm run build pass.
• ansi-to-react still renders URLs as links with linkify-it 5.

Questions:

• Does the license files need to update? No.
• Is there breaking changes for older versions? No.
• Does this needs documentation? No.

[tbonelee]

Merged into master