fix: bump @microsoft/api-extractor to fix security vulnerabilities (#462)

Upgrades `@microsoft/api-extractor` from `^7.52.9` to `^7.57.0` in both
the root and `packages/vite-plugin-dts` devDependencies. The old version
pulled in vulnerable transitive deps:

- minimatch@~3.0.3 (CVE: GHSA-7r86-cg39-jmmj, GHSA-3ppc-4f35-3m26)
- lodash@~4.17.15 (CVE: GHSA-xxjr-mmjv-4gpg)
- ajv@<8.18.0 via @microsoft/tsdoc-config (CVE: GHSA-2g4f-4pwh-qvx6)

`@microsoft/api-extractor@7.57.x` switched to minimatch@10.x and
lodash@~4.17.23, resolving all three vulnerability chains.

Adds `pnpm.overrides` to force:
- `@microsoft/api-extractor@<7.57.6` → 7.57.6 (covers peer dep resolution
  in packages/unplugin-dts which declares `>=7`)
- `minimatch@>=10.0.0 <10.2.3` → 10.2.4 (api-extractor 7.57.x uses
  minimatch@10.2.1 which itself has a ReDoS fix in >=10.2.3)

Author: yadprab

package.json

@@ -32,7 +32,7 @@
     "@commitlint/cli": "^19.8.0",
     "@commitlint/types": "^19.8.0",
     "@eslint/js": "^9.31.0",
-    "@microsoft/api-extractor": "^7.52.9",
+    "@microsoft/api-extractor": "^7.57.0",
     "@rspack/core": "^1.3.9",
     "@types/debug": "^4.1.12",
     "@types/minimist": "^1.2.5",
@@ -66,5 +66,11 @@
     "vite": "^6.3.3",
     "vitest": "^3.1.2",
     "webpack": "^5.100.2"
+  },
+  "pnpm": {
+    "overrides": {
+      "@microsoft/api-extractor@<7.57.6": "7.57.6",
+      "minimatch@>=10.0.0 <10.2.3": "10.2.4"
+    }
   }
 }

packages/vite-plugin-dts/package.json

@@ -53,7 +53,7 @@
     "unplugin-dts": "workspace:*"
   },
   "devDependencies": {
-    "@microsoft/api-extractor": "^7.52.5"
+    "@microsoft/api-extractor": "^7.57.0"
   },
   "peerDependencies": {
     "@microsoft/api-extractor": ">=7",