fix(deps): bump js-yaml to 4.3.2 (GHSA-2883-xcg3-v3hh)

[jaideepp247]

Fixes #6158

js-yaml is pinned to 4.3.1, which falls in the range covered by GHSA-2883-xcg3-v3hh (high severity): maxTotalMergeKeys does not limit CPU use for empty merge sources. The advisory's first patched release is 4.3.2.

The published pm2@7.0.4 pins js-yaml at exactly 4.3.1 rather than a semver range, so installs resolve to the affected version and won't pick up 4.3.2 through a normal update.

This bumps the pin to 4.3.2 — a patch release within the same major, so there's no API change. PM2 calls yaml.load() in lib/Common.js; that signature and behaviour are unchanged.

Opened against development per CONTRIBUTING.md — happy to retarget to master, or to take 5.4.1 instead if you'd prefer the major bump.

[CLAassistant]

All committers have signed the CLA.