chore(docs): patch astro, dompurify, and esbuild advisories

[joshua-temple]

Clears the residual Scorecard vulnerability advisories in the docs npm tree (the only open code-scanning alert after the generator and repo hardening PRs).

• astro 6.4.3 -> 6.4.8 (direct): fixes the Host-header SSRF and spread-props XSS advisories. Stays within 6.x; the docs build requires Node >= 22, which CI already uses.
• dompurify 3.4.10 -> 3.4.11 (transitive): fixes the ALLOWED_ATTR pollution advisory, resolved by a plain lockfile refresh.
• esbuild 0.27.7 -> 0.28.1 via a minimal overrides entry: fixes the dev-server file-read advisory; the parent only offered it through a major astro 7 jump otherwise.

Verification: npm audit goes from 1 high / 1 moderate / 1 low to 0 with no new advisory, and npm run build succeeds with all 13 pages built.