chore(deps): clear remaining npm audit highs from unpatched image-size

[danbaruka]

Summary

After #286, npm audit on website/ still reports 19 high vulnerabilities. All of them cascade from transitive image-size@2.0.2 (via @docusaurus/mdx-loader).

Current signal

• npm audit: 19 high (0 critical / moderate / low outside this tree)
• Root package: image-size@2.0.2
• Advisories with no upstream patched release:
  • GHSA-5p2g-fcmc-qvqq (JXL/HEIF infinite loop DoS)
  • GHSA-w3rx-r6r6-pgpr (ICNS infinite loop DoS)

Goals

1. Ship a local patched image-size (versioned as 2.0.3) that advances offsets safely on zero-sized boxes/entries
2. Pin it via npm overrides + Yarn resolutions
3. Get npm audit to 0 while keeping npm run build green

Acceptance criteria

• cd website && npm audit → 0 vulnerabilities
• cd website && npm run build succeeds
• Override is documented so we can drop it when upstream publishes a fix

Notes

Upstream image-size latest on npm is still 2.0.2 with no fix release for these advisories.