fix: upgrade postcss to 8.5.18 (GHSA-r28c-9q8g-f849)

[anupamme]

Summary

Upgrade postcss from 8.5.3 to 8.5.18 to fix GHSA-r28c-9q8g-f849.

Vulnerability

Field	Value
ID	GHSA-r28c-9q8g-f849
Severity	HIGH
Scanner	trivy
Rule	GHSA-r28c-9q8g-f849
File	packages/vue-router/package-lock.json (dependency: postcss)
Assessment	Present in dependency tree, not confirmed reachable

Description: PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

Changes

• packages/vue-router/package.json
• packages/vue-router/package-lock.json

Behavior Preservation

The change is scoped to 2 files on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

This patch removes an exploit primitive — a code pattern that, while not independently exploitable today, could be chained with other weaknesses by automated exploit-development tooling. Proactive removal of such primitives raises the bar against increasingly capable automated attack tools.

---

Automated security fix by OrbisAI Security

[vercel]

@anupamme is attempting to deploy a commit to the Ionic Team on Vercel.

A member of the Team first needs to authorize it.

[anupamme]

Flagging overlap with #31318, which also touches `packages/vue-router`'s postcss resolution.

This PR targets postcss 8.5.18 (fixes GHSA-r28c-9q8g-f849). However, `main` has since moved to postcss 8.5.14 by default (no override), and there's a further postcss fix in 8.5.23 for the case where `opts.from` is unset. 8.5.18 alone wouldn't cover that.

I've updated #31318 to rebase onto current `main` and pin the override to postcss 8.5.23 (chosen over the latest 8.5.26 since 8.5.24 reportedly introduced a BOM regression for some consumers), with before/after `npm ls postcss` verification in the description.

To avoid landing two overlapping postcss security PRs, would it make sense to consolidate on whichever of these two you'd rather merge? Happy to close #31318 if you'd prefer to bump the target here to 8.5.23 instead, or vice versa.