This library is pinning an old version of `yaml` which now has a security issue

[kgetz-arista]

This library is hardcoding an old version of yaml here:

https://github.com/tiktok/pnpm-sync/blob/main/packages/pnpm-sync-lib/package.json#L25

This version now has a security issue, which is showing up in our repo via this package:

┌───────────────┬───────────────────────────────────────────────────────────────────────────────────────┐
│ Issue         │ yaml is vulnerable to Stack Overflow via deeply nested YAML collections               │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────┤
│ Severity      │ moderate                                                                              │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────┤
│ Dependency    │ yaml                                                                                  │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────┤
│ Version       │ 2.4.1                                                                                 │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────┤
│ Full path     │ packages > rush-artifactory-cache-plugin > @microsoft/rush-lib > pnpm-sync-lib > yaml │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────┤
│ Vulnerable in │ >=2.0.0 <2.8.3                                                                        │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.8.3                                                                               │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────┤
│ Suggested fix │ Upgrade to version 2.8.3 or later                                                     │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────┤
│ More info     │ https://github.com/advisories/GHSA-48c2-rrv3-qjmp                                     │
└───────────────┴───────────────────────────────────────────────────────────────────────────────────────┘

Recommendation: don't pin specific versions, use version ranges instead. Also, upgrade to 2.8.x.

[kgetz-arista]

@octogonz I see you're the most recent committer in this repo (10 months ago!). Is this package still being maintained? If not, maybe Rush should consider migrating to a different one?

[octogonz]

If someone wants to make a PR to upgrade the NPM package, I can help get it merged.

[faizanongit]

@octogonz Could you please review ? - #46