chore: update to lts stable ohif (3.12.11)

[igoroctaviano]

Context

Update ViewersV3 to the latest OHIF LTS stable release v3.12.11 (from v3.12.5).

Upstream releases included since 3.12.5:

• 3.12.6 – version bump
• 3.12.7 – websocket-driver security
• 3.12.8 – dependency security updates
• 3.12.9 – dependency security updates
• 3.12.10 – postcss 8.5.22
• 3.12.11 – brace-expansion security

Changes & Results

• Merged OHIF tag v3.12.11 into ViewersV3 master
• Kept IDC CircleCI deployment config and IDC-specific app deps (GCP extension/mode, IDC extension, default config)
• Combined upstream security resolutions with remaining IDC patches (fast-uri, @xhmikosr/decompress)
• Regenerated yarn.lock / bun.lock (and docs lockfile) against the merged resolutions
• Took upstream Playwright screenshots from v3.12.11

Testing

• yarn install / bun install succeeds
• Viewer builds (yarn build or deploy pipeline)
• Smoke: open IDC viewer, load a study, switch modes
• Confirm GCP mode/extension still load

Checklist

PR

• My Pull Request title is descriptive, accurate and follows the
  semantic-release format and guidelines.

Code

• My code has been well-documented (function documentation, inline comments,
  etc.)

Public Documentation Updates

• The documentation page has been updated as necessary for any public API
  additions or removals.

Tested Environment

• OS: macOS
• Node version: 20.x
• Browser: Chrome

[igoroctaviano]

Fork safety follow-up pushed

Reviewed this bump for IDC-fork regressions/CI pain. Findings + fixes:

Hard CI break (fixed)

Upstream Playwright workflow required runs-on: [self-hosted, nashua] plus .scripts/ci/with-nashua-lock.sh. This fork has zero self-hosted runners (/actions/runners is empty), so the PR check was stuck queued forever.

Fix: run Playwright on ubuntu-latest, drop the nashua mutex script, and remove the nashua-only --use-gl=egl Chromium arg.

Dependabot regression (fixed)

Regenerating lockfiles for 3.12.11 reintroduced vulnerable minimatch pins (3.1.2 / 5.1.6 / 9.0.5 / 10.2.1). Restored patched versions in root + docs lockfiles. decompress → @xhmikosr/decompress@11.1.3 was already preserved.

Safe / preserved for IDC

• CircleCI deploy config (idc-deploy-shell, tiered buckets) untouched
• @ohif/extension-idc, @idc/gcp-extension, @idc/gcp-mode still in platform/app
• IDC configs (default.js, idc.js, etc.) unchanged by the merge

Residual risk (acceptable, not blocking)

• Playwright is not a required status check; even if screenshots flake on GH-hosted runners vs OHIF nashua baselines, merge/deploy via CircleCI is unaffected
• Upstream brace-expansion: 1.1.18 resolution collapses ^2/^5 ranges (same as OHIF v3.12.11); keep an eye on install/build, but this is intentional LTS security content
• Please smoke CircleCI deploy after merge (GCP mode/extension load)