fix: replace vulnerable xlsx dependency

[alexandroit]

What

Replace the direct xlsx@^0.18.5 dependency of the amis package with the npm
alias xlsx@npm:@stackline/xlsx@^1.0.6. Existing imports continue to resolve as
xlsx; no component or public API changes are required.

Why

The currently resolved direct dependency is affected by:

• GHSA-4r6h-8v6p-xvw6
• GHSA-5pgg-2g8v-p4x9

@stackline/xlsx is an independent Apache-2.0 SheetJS-compatible fork with
regression coverage for both advisories. It has no runtime dependencies and
requires Node 20 or newer, matching the current build and test environment.

Disclosure: I maintain @stackline/xlsx. Package and source links are
https://www.npmjs.com/package/@stackline/xlsx and
https://github.com/alexandroit/sheetjs.

How

• Built amis-formula, amis-core, amis-ui, and amis successfully.
• Built amis-editor-core and amis-editor successfully.
• Ran the repository typecheck successfully.
• Ran the InputExcel Jest suite: 11 tests passed.
• Ran an XLSX write/read and prototype-pollution smoke test successfully.

Scope note: amis-editor-core separately reaches xlsx@0.17.5 through
i18n-command -> node-xlsx. This PR only fixes the direct production dependency
of the published amis package and does not claim to remove that separate
transitive path from the whole monorepo.

[github-actions]

👍 Thanks for this!
🏷 I have applied any labels matching special text in your issue.

Please review the labels and make any necessary changes.