Build: Upgrade to js-yaml 3.1.0

Use `.safeLoad()` instead of `.load()`.

https://nodesecurity.io/advisories/JS-YAML_Deserialization_Code_Execution