chore(collector): override postcss to >=8.5.23 to clear the source-map path-traversal advisory

postcss reaches us transitively through tsup -> postcss-load-config, so it goes
in the existing pnpm.overrides block alongside esbuild and vite rather than into
devDependencies. 8.5.15 -> 8.5.26.

Covers both open advisories: the sourceMappingURL auto-load path traversal that
discloses arbitrary .map files, and its incomplete fix (GHSA-6g55-p6wh-862q)
where an attacker-controlled sourceMappingURL still reads arbitrary .map files
when `from` is unset.

brace-expansion was the third collector alert and is already at the patched
2.1.2 here, pulled in by the eslint bump in 908f5c2.

Author: datascry

collector/package.json

@@ -28,6 +28,7 @@
   "pnpm": {
     "overrides": {
       "esbuild": ">=0.28.1",
+      "postcss": ">=8.5.23",
       "vite": "^6.4.3"
     }
   },