fix(security): CVE-2026-27212 patched. Various dependency updates as a result of CVE-2026-26996. (#5830)

fix(security):  CVE-2026-27212 patched.
Various dependency updates as a result of CVE-2026-26996.
Ultimately CVE-2026-26996 was ignored because it is only exposed in itk-wasm via CLI and OHIF's other use of minimatch is limited to build/dev environments.

package.json

@@ -103,16 +103,14 @@
     "@istanbuljs/nyc-config-typescript": "1.0.2",
     "@pmmmwh/react-refresh-webpack-plugin": "0.5.17",
     "babel-loader": "8.4.1",
-    "babel-plugin-istanbul": "7.0.0",
+    "babel-plugin-istanbul": "7.0.1",
     "babel-plugin-transform-import-meta": "2.3.3",
     "cross-env": "7.0.3",
     "css-loader": "6.11.0",
     "cypress": "14.5.2",
     "cypress-file-upload": "5.0.8",
     "file-loader": "6.2.0",
-    "istanbul": "0.4.5",
     "nyc": "17.1.0",
-    "patch-package": "8.0.0",
     "playwright-test-coverage": "1.2.12",
     "postcss-loader": "6.2.1",
     "prettier": "3.6.2",