`pacote` has a CVE out for the version in @angular/cli (20 and 22)

### Command

other

### Is this a regression?

- [ ] Yes, this behavior used to work in the previous version

### The previous version in which this bug was not present was

_No response_

### Description

Per CVE-2026-9496, `pacote` dependencies should be updated to at least version 21.5.1 (github's page on it is a little behind - Snyk identifies that 21.5.1 has the fix [here](https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084)).

This is currently affecting @angular/cli, both versions 20 and 22

### Minimal Reproduction

1. Initialize a new Angular project with `npx -p @angular/cli@20 ng new`
2. In the new project, run `npm explain pacote` and note that the version (`21.0.4`) is affected by the CVE

### Your Environment

```text
Angular CLI: 20.3.28
Node: 22.22.3
Package Manager: npm 10.9.8
OS: win32 x64


Angular: 20.3.25
... common, compiler, compiler-cli, core, forms
... platform-browser, router

Package                      Version
------------------------------------
@angular-devkit/architect    0.2003.28
@angular-devkit/core         20.3.28
@angular-devkit/schematics   20.3.28
@angular/build               20.3.28
@angular/cli                 20.3.28
@schematics/angular          20.3.28
rxjs                         7.8.2
typescript                   5.9.3
zone.js                      0.15.1
```

### Anything else relevant?

_No response_

[]