fix(deps): resolve 15 GitHub-flagged vulnerabilities (7 high, 8 moderate) (#117)

next 16.2.9 -> 16.2.12: unauthenticated disclosure of internal Server
Function endpoints, two SSRF paths (Server Actions on custom servers,
rewrites via attacker-controlled hostname), middleware/proxy bypass,
plus DoS/cache-confusion advisories.

hono 4.12.25 -> 4.12.33: server-side XSS via JSX cx() escaping bypass,
cross-request data disclosure (jsx context not isolated per request),
header de-dup dropping repeated values.

New sharp override (^0.35.0, matching the same fix already applied in
nyuchi-docs): next pulls in sharp transitively for Image Optimization,
and the installed 0.34.5 inherits four libvips CVEs. postcss's existing
override picked up the patched line automatically once the lockfile
refreshed. brace-expansion (two DoS variants, dev-only via eslint's
minimatch chain) resolved the same way.

npm audit: 0 vulnerabilities (down from 5 packages / 15 advisories).

Co-authored-by: Bryan Fawcett <noreply@anthropic.com>

Author: bryanfawcett