@xmldom/xmldom override needs both floor and ceiling — open-ended range floats past plist compat

Forcing plist>=3.1.1 via pnpm overrides bumps it to v5.x, which breaks @electron/osx-sign@1.0.5 (used by electron-builder@24.13.3) due to incompatible CJS require() and new exports map. Fix: remove the plist override and instead override @xmldom/xmldom directly to >=0.8.13 (first patched 0.8.x version). This keeps plist@3.1.0 for osx-sign compatibility while eliminating the @xmldom/xmldom vulnerability.