chore(deps): Bump Lerna to v9 (#19244)

- Bumps `lerna` from 8.2.4 to 9.0.3 to resolve

[CVE-2025-64718](GHSA-mh29-5h37-fv8m)
  (medium severity prototype pollution in `js-yaml`)
- `lerna@8.2.4` pulled in `js-yaml@4.1.0` (vulnerable); `lerna@9.0.3`
depends on
  `js-yaml@4.1.1` (patched)
- Lerna 9 drops support for Node <18.18.0. This doesn't affect us —
lerna runs in the root
workspace context using Volta's pinned Node 20.19.2. The `engines: >=18`
fields in dev-packages
are runtime compatibility declarations, not what CI uses to run lerna.

Resolves
https://github.com/getsentry/sentry-javascript/security/dependabot/789

Author: chargome

package.json

@@ -125,7 +125,7 @@
     "es-check": "^7.2.1",
     "eslint": "8.57.0",
     "jsdom": "^21.1.2",
-    "lerna": "8.2.4",
+    "lerna": "9.0.3",
     "madge": "8.0.0",
     "nodemon": "^3.1.10",
     "npm-run-all2": "^6.2.0",