Move vulnerable dependencies to patched versions

- @pezkuwi/typegen requires handlebars ^4.7.9; 4.7.8 and earlier are
  affected by the open handlebars advisories
- yarn.lock: tar, ip-address, brace-expansion, fast-uri, js-yaml,
  node-forge, postcss, lodash, ws and the other flagged transitive
  packages resolve to patched releases within their declared ranges

The flagged packages still on an affected version are reached only
through the @pezkuwi/dev tool chain (webpack-dev-server 4, eslint 8,
gh-release), which pins their major versions; they are development
tools and are not part of any published package.

packages/typegen/package.json

@@ -42,7 +42,7 @@
     "@pezkuwi/util-crypto": "14.0.26",
     "@pezkuwi/x-ws": "14.0.26",
     "comment-parser": "^1.4.1",
-    "handlebars": "^4.7.8",
+    "handlebars": "^4.7.9",
     "tslib": "^2.8.1",
     "yargs": "^17.7.2"
   }