Upgrade postcss-selector-parser to 7.1.6: fixes GHSA-rj75-hqrm-r3gf #105

postcss-selector-parser (npm) has known vulnerabilities with a fix in 7.1.6. Upgrade it to 7.1.6 or later everywhere it is locked, keeping other changes to what the upgrade needs.

Locked in: package-lock.json (6.1.4).

The acceptance checks pass once no lockfile resolves a vulnerable version and the tests still pass. If the fix needs a major upgrade that breaks the build, change the code that depends on it in the same pull request.

---

Opened by g1t's dependency upkeep. Turn it off for this project on its Security page.

Definition of done

• node -e 'const l=require(require('\''path'\'').resolve(process.argv[1]));const hit=Object.entries(l.packages||{}).some(([k,p])=>k.endsWith('\''node_modules/postcss-selector-parser'\'')&&p.version==='\''6.1.4'\'');process.exit(hit?1:0)' 'package-lock.json' passes.
• npm ci && npm test --if-present passes.