Update xmlbuilder2 to >=4.0 to fix js-yaml vulnerability

[brokenpc00]

Hi,
saml2-js@4.0.4 depends on xmlbuilder2@^2.4.0, which uses js-yaml@3.14.0 and has a prototype pollution vulnerability (CVE-2025-64718).

Could saml2-js update xmlbuilder2 to >=4.0 so that a patched js-yaml (>=4.1.1) can be used? This would mitigate the security risk.

This issue description was drafted with the assistance of ChatGPT.

Thanks!

[JasonGloverNZ]

There's a PR up for it already - #292
But the PR was rejected by a SOC PR Bot due to it finding testing notes but no JIRA ticket reference.

Red tape