chore(site): take in-range security updates in the lockfile

npm audit fix --package-lock-only; package.json is unchanged, so every
bump stays inside the declared ranges. 9 advisories drop to 3. The site
builds identically before and after (2 pages, 7 files, no warnings).

The remaining three (astro, sharp, esbuild) need astro 5 -> 7, a major
upgrade left for its own change. The critical astro advisories need
define:vars or server islands, and this static site uses neither.

Refs #1

Author: Seungpyo1007