[pull] main from tinacms:main - #309

Closes #7453

**TL;DR** #7447 fixed the vulnerable js-yaml but merged without a
changeset, so the fix is sitting on `main` unreleased. This adds one.

**Pain:** `@tinacms/cli` is published and not in the changesets `ignore`
list, so a dependency change there needs a changeset to produce a
version bump and a release. #7447 moved it from the vulnerable js-yaml
4.1.1 to 4.3.1, closing GHSA-5p4m-2wfm-xmqj on `main`, but with no
changeset there is no release. The published package keeps resolving
4.1.1, so `npm install @tinacms/cli` still pulls the vulnerable copy and
the advisory stays open for users.

**Solution:** Adds a changeset marking `@tinacms/cli` `patch` and naming
the js-yaml bump with its advisory. Version Packages #7443 is still
open, so this is picked up in the current release rather than the one
after.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Closes #7455

**TL;DR** #7425 and #7321 merged without changesets, so both fixes are
stranded on `main`. This adds them.

**Pain:** `@tinacms/graphql` and `tinacms-authjs` are both published and
neither is in the changesets `ignore` list, so a dependency change in
either needs a changeset to produce a version bump and a release. #7425
moved `@tinacms/graphql` to js-yaml 3.15.1 and #7321 moved
`tinacms-authjs` to next-auth 4.24.15, both without one. The js-yaml
case matters most: it closed GHSA-5p4m-2wfm-xmqj on the 3.x line, and
`@tinacms/graphql` is the package that parses content YAML, so the
published package still resolves the vulnerable 3.14.2 until a release
ships.

**Solution:** Adds a changeset for each, both `patch`, naming the bump
and its advisory where there is one. Version Packages #7443 is still
open, so these are picked up in the current release rather than the one
after.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.21 to 7.5.22.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/isaacs/node-tar/commit/2a22bfc5d3a432a606d9da0e2d87ba634aa3b1cb"><code>2a22bfc</code></a>
7.5.22</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/df1cd8dc09cded47b00c4129698824b3986432ac"><code>df1cd8d</code></a>
Allow transform to be falsey</li>
<li>See full diff in <a
href="https://github.com/isaacs/node-tar/compare/v7.5.21...v7.5.22">compare
view</a></li>
</ul>
</details>
<br />

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kulesy <kulewidak@gmail.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Eli Kent [SSW] <69125238+kulesy@users.noreply.github.com>