fix: re-remove tar and undici from devDependencies (PRI-560)

The merge conflict resolution reverted the f0de1fa fix. Re-applied removal of duplicate tar@^7.5.11 and undici@^7.24.3 from devDependencies — both are already pinned via pnpm.overrides. Also removed the spurious overrides.lodash block that was reintroduced.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

package.json

@@ -52,12 +52,7 @@
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "react-router-dom": "^5.3.0",
-    "tar": "^7.5.11",
     "typescript": "~5.6.2",
-    "undici": "^7.24.3",
     "vitest": "^3.0.5"
-  },
-  "overrides": {
-    "lodash": ">=4.18.0"
   }
 }

pnpm-lock.yaml

@@ -58,15 +58,9 @@ importers:
       react-router-dom:
         specifier: ^5.3.0
         version: 5.3.4(react@18.3.1)
-      tar:
-        specifier: ^7.5.11
-        version: 7.5.13
       typescript:
         specifier: ~5.6.2
         version: 5.6.3
-      undici:
-        specifier: ^7.24.3
-        version: 7.25.0
       vitest:
         specifier: ^3.0.5
         version: 3.2.4(@types/debug@4.1.13)(@types/node@20.19.39)(jsdom@24.1.3)(msw@2.4.9(typescript@5.6.3))(terser@5.46.1)(yaml@2.8.3)