deps: CVE audit + refresh safe pins, document held ones (T-353)

Reviewed every direct and transitive dependency against the GitHub
Advisory Database / OSV (Pub ecosystem). No advisory affects any
dependency at its current pin or upgrade target — the "N packages have
newer versions" noise is freshness, not security. (Consistent with
`dart pub get` printing no advisory warnings.)

Bumped the safe pins + their licenses.yaml entries in the same commit:
- ffi 2.1.3 -> 2.2.0
- jovial_svg 1.1.26 -> 1.1.30 (pulls jovial_misc 0.10.0 + xml 7.0.1)
- mocktail 1.0.4 -> 1.0.5

Held, with the reason recorded inline in pubspec.yaml:
- markdown 7.2.2: 7.3.1 requires Dart ^3.9.0 — defer to an SDK-floor bump
- alchemist 0.12.1: 0.13.0 disabled text anti-aliasing -> golden churn
- test 1.31.0: flutter_test SDK-locks the resolvable ceiling

make test green (incl. SVG/xml goldens — the xml 6->7 major didn't churn
rendering).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/licenses.yaml

@@ -116,7 +116,7 @@ dependencies:
 
   - name: ffi
     kind: dart-package
-    version: "2.1.3"
+    version: "2.2.0"
     homepage: https://pub.dev/packages/ffi
     license: BSD-3-Clause
     purpose: >-
@@ -171,7 +171,7 @@ dependencies:
 
   - name: jovial_svg
     kind: dart-package
-    version: "1.1.26"
+    version: "1.1.30"
     homepage: https://pub.dev/packages/jovial_svg
     license: BSD-3-Clause
     purpose: >-
@@ -207,7 +207,7 @@ dependencies:
 dev_dependencies:
   - name: mocktail
     kind: dart-package
-    version: "1.0.4"
+    version: "1.0.5"
     homepage: https://pub.dev/packages/mocktail
     license: MIT
     purpose: >-