Bump dependencies

[bobvandevijver]

• Bump js-cookie from 3.0.5 to 3.0.8 #3725
• Bump tmp from 0.2.5 to 0.2.7 #3728
• Bump axios from 1.15.2 to 1.16.0 #3729
• Make default query limit configurable via query_default_limit #3727 (single commit)

[Copilot]

Pull request overview

This PR bumps selected JavaScript dependencies and applies PHPStan-oriented casts around mb_trim() / mb_rtrim() usage so the code remains compatible with PHP 8.4 static analysis while preserving existing behavior.

Changes:

• Updated axios to ^1.16.1 and refreshed lockfile entries for axios, js-cookie, and tmp.
• Added explicit (string) casts around mb_trim() / mb_rtrim() results in strict string contexts.
• Removed the now-obsolete PHPStan baseline ignore for ContentRepository.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/Twig/ContentExtension.php	Casts mb_rtrim() result before returning a string excerpt.
src/Repository/ContentRepository.php	Casts json_encode() and mb_trim() results before building the search term.
src/Menu/FrontendMenuBuilder.php	Casts trimmed menu links before URI checks.
src/Entity/Translatable/BoltTranslationTrait.php	Casts trimmed string values before measuring length.
src/Canonical.php	Casts trimmed scheme before assigning to a string property.
phpstan-baseline.php	Removes the resolved PHPStan ignore entry.
package.json	Bumps axios dependency constraint.
package-lock.json	Updates resolved package versions and dependency metadata.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.