ci: combine main dependency security bumps

[Qjzn]

This combines the two main-target dependency security updates that are blocked when checked independently:

• ci: bump @xmldom/xmldom from 0.8.13 to 0.8.15 #85: @xmldom/xmldom 0.8.13 -> 0.8.15
• ci: bump qs from 6.15.3 to 6.16.0 #86: qs 6.15.3 -> 6.16.0

Reason:

• Each original PR leaves one remaining moderate audit finding, so its individual build check fails.
• The combined candidate resolves the audit set together.

Local verification on Windows, isolated worktree from origin/main:

• npm 10.9.8 via temporary npm tarball
• npm ci: 0 vulnerabilities
• npm run verify:dependency-security: passed, 0 vulnerabilities across 437 dependencies
• npm run build:frontend: passed