fix: bump winston from 3.17.0 to 3.18.3

Bumps [winston](https://github.com/winstonjs/winston) from 3.17.0 to 3.18.3.
- [Release notes](https://github.com/winstonjs/winston/releases)
- [Changelog](https://github.com/winstonjs/winston/blob/master/CHANGELOG.md)
- [Commits](winstonjs/winston@v3.17.0...v3.18.3)

---
updated-dependencies:
- dependency-name: winston
  dependency-version: 3.18.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Author: dependabot[bot]

core/cli/package.json

@@ -26,7 +26,7 @@
     "@types/pluralize": "^0.0.33",
     "globby": "^10.0.2",
     "type-fest": "^4.41.0",
-    "winston": "^3.17.0",
+    "winston": "^3.18.3",
     "zod": "^3.24.4"
   },
   "dependencies": {

lib/base/package.json

@@ -14,13 +14,13 @@
     "@dotcom-tool-kit/logger": "^4.2.2",
     "@dotcom-tool-kit/validated": "^1.0.3",
     "semver": "^7.7.3",
-    "winston": "^3.17.0"
+    "winston": "^3.18.3"
   },
   "devDependencies": {
     "@dotcom-tool-kit/config": "^1.1.1",
     "@dotcom-tool-kit/plugin": "^1.1.0",
     "type-fest": "^4.41.0",
-    "winston": "^3.17.0",
+    "winston": "^3.18.3",
     "zod": "^3.24.4"
   },
   "peerDependencies": {

lib/doppler/package.json

@@ -31,7 +31,7 @@
   },
   "devDependencies": {
     "spawk": "^1.8.2",
-    "winston": "^3.17.0"
+    "winston": "^3.18.3"
   },
   "engines": {
     "node": "18.x || 20.x || 22.x"

lib/logger/package.json

@@ -29,7 +29,7 @@
     "chalk": "^4.1.0",
     "triple-beam": "^1.4.1",
     "tslib": "^2.8.1",
-    "winston": "^3.17.0",
+    "winston": "^3.18.3",
     "winston-transport": "^4.9.0"
   },
   "devDependencies": {

lib/wait-for-ok/package.json

@@ -20,7 +20,7 @@
   "bugs": "https://github.com/financial-times/dotcom-tool-kit/issues",
   "homepage": "https://github.com/financial-times/dotcom-tool-kit/tree/main/lib/wait-for-ok",
   "devDependencies": {
-    "winston": "^3.17.0"
+    "winston": "^3.18.3"
   },
   "files": [
     "/lib",