…cal SSRF vulnerability (#28620)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

CI is failing on `yarn audit:ci` due to a critical severity advisory
([GHSA-3p68-rc4w-qgx5](GHSA-3p68-rc4w-qgx5))
in axios < 1.15.0. The vulnerability allows an attacker to bypass
`NO_PROXY` hostname normalization, leading to SSRF.

This PR bumps axios from 1.13.5 to 1.15.0 across `dependencies`,
`resolutions`, and the CI scripts package. Because 1.15.0 was published
less than 3 days ago, it is also temporarily added to
`npmPreapprovedPackages` in `.yarnrc.yml` to bypass the
`npmMinimalAgeGate`. This preapproval entry should be removed after
2025-04-12.

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: null

## **Related issues**

Fixes:

## **Manual testing steps**

```gherkin
Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Updates a widely used HTTP client to remediate a critical SSRF
advisory; moderate risk due to potential subtle networking/proxy
behavior changes across the app and CI scripts.
> 
> **Overview**
> **Bumps `axios` from `^1.13.5` to `^1.15.0` across the repo** (app
`dependencies`, `resolutions`, and the `.github/scripts` workspace) to
address the flagged security advisory.
> 
> Updates both lockfiles to the new `axios` and its transitive
`proxy-from-env@^2.1.0`, and temporarily adds `axios` to `.yarnrc.yml`
`npmPreapprovedPackages` to bypass the 3-day `npmMinimalAgeGate` for
this release.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
34350ca. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->