fix(bindings/node): bump js-yaml to 4.3.0 for GHSA merge-key DoS

js-yaml < 4.3.0 lets chained YAML merge keys force quadratic CPU
consumption. It reaches the tree as a dev-only transitive of
@napi-rs/cli, so the lockfile is the only place to pin it.

Regenerating the lockfile also syncs the root name with the scoped
@nodedb-lab/code2graph package name already set in package.json.

Author: farhan-syah