Use per-major bounded ranges for pnpm overrides

When adding pnpm.overrides to fix security vulnerabilities, scope overrides per-major-version when multiple major versions of a package exist in the dependency tree (e.g., separate ranges for brace-expansion 2.x and 5.x rather than a blanket <3 range). Also bound major-version overrides with an upper limit (e.g., <8 for Vite). This prevents forcing incompatible major versions onto consumers and avoids over-broad overrides that break transitive dependencies. Learned from a prior gotcha where a blanket <3 brace-expansion override was wrong.