chore(deps): clear security advisories and block the unusable TypeScript 7 major

[jigarkhwar]

Supersedes #19, which cannot be merged.

Why the TypeScript 7 bump in #19 is not viable

TypeScript 7 is the native (Go) compiler rewrite. Its npm package no longer
ships the classic programmatic API — the . export is literally just
lib/version.cjs, a version string, with the new API behind ./unstable/*:

exports: { ".": "./lib/version.cjs", "./unstable/sync": ..., "./unstable/ast": ... }

Volar — and therefore @astrojs/language-server and astro check — needs that
classic API, so @astrojs/check caps its peer range at ^5 || ^6. This is a
real incompatibility, not stale metadata:

• npm ci fails outright on the peer conflict (this is the red CI on chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 in the npm-dependencies group #19).
• Forcing past it with an overrides entry installs fine, but npm run typecheck
  then aborts: "The TypeScript module loaded (found 7.0.2) does not expose the
  programmatic API that astro check relies on."
• Pinning a nested TS 6 just for @astrojs/check does not work either — npm
  hoists 7.0.2 to the root, astro check still loads it, and the tree is left
  in an invalid (ELSPROBLEMS) state.
• No published release or prerelease of @astrojs/check supports TS 7 yet
  (latest is 0.9.10; the alpha/beta tags are older).

Swapping astro check for TS 7's tsc --noEmit would make CI green but silently
gut coverage. Measured on this repo with a deliberate type error planted in
src/components/Product.astro:

Setup	.ts files	.astro files	Verdict on the planted error
TS 6 + astro check	checked	checked	caught at Product.astro:19
TS 7 + tsc --noEmit	checked	ignored	"No errors found"

Half the source (8 .astro files — every component plus the only page) would stop
being type-checked. Not worth it for a compiler the project never invokes directly.

What this PR does instead

Ignore the TypeScript major in Dependabot until upstream lands support, so the
broken PR stops being regenerated weekly. Tracked at
withastro/roadmap#1321 — remove the ignore block once @astrojs/check supports TS 7.

Clear both high-severity advisories that were already present on main
(lockfile-only, transitive under astro):

• sharp 0.34.5 -> 0.35.3 — inherited libvips CVEs (GHSA-f88m-g3jw-g9cj)
• svgo 4.0.1 -> 4.0.2 — removeScripts left executable scripts intact (GHSA-2p49-hgcm-8545)

Verification

npm ci && npm run validate from a clean node_modules: 0 errors, 0 warnings,
0 hints, build completes, 4 pages emitted. npm audit now reports 0 vulnerabilities
(was 2 high).