fix(deps): bump astro to fix RCE and auth-bypass CVEs

[SafraNako]

What

astro was pinned at 7.1.6, which is affected by two published GitHub
Security Advisories fixed in later 7.x releases:

• GHSA-26w7-cxv4-gfx2 — remote code execution through AVIF image optimization (fixed in 7.2.8)
• GHSA-376h-93r7-7g6f — authorization bypass from a missing path-segment boundary check when stripping the configured base (fixed in 7.2.4)

Found via npm audit after a routine OSV/dependency sweep; not something
I saw exploited, just a known-vulnerable version still in the lockfile.

Root cause / exposure

This site builds with Astro's default static output — no output/adapter
is configured in astro.config.mjs — so the on-demand image and routing
code paths these advisories describe aren't exposed to visitors of
docs.internetcomputer.org. The realistic exposure is build-time
processing of repository content (e.g. a crafted image landing in a content
PR triggering the AVIF codepath during astro build). Still worth fixing
since a patched release is available and it's a routine bump.

Fix

• astro ^7.1.6 → ^7.3.2, and its peer @astrojs/markdown-remark
^7.2.2 → ^7.3.1 (astro 7.3.x requires @astrojs/markdown-remark ^7.3.0
  as a peer, so both need bumping together or npm install fails to
  resolve).
• Along the way, npm audit also flagged nanoid@3.3.17 (pulled in
  transitively via astro → vite → postcss → nanoid) for a separate
  advisory — custom generators loop indefinitely when called with size 0.
  Pinned to ^3.3.19 via overrides since it's several levels deep in
  Astro's own dependency tree and not something bumping astro alone fixes.

Verified locally

• npm audit → 0 vulnerabilities (was 1 critical + 1 high)
• npm ci installs cleanly from the regenerated lockfile
• npm run build still produces the same 210 pages as before the bump

Only package.json and package-lock.json changed — no content or config touched.

🤖 Generated with Claude Code

[SafraNako]

Closing as a duplicate of #384 (Dependabot), which already covers the astro 7.1.6→7.3.2 bump and beat me to it by 2 days — sorry for the noise, should have checked for an open Dependabot PR before opening this.

One gap for whoever picks up #384: its lockfile diff doesn't touch nanoid, so nanoid@3.3.17 (GHSA: custom generators loop indefinitely with size 0) will likely still be present after merging it, since it's several levels deep (astro → vite → postcss → nanoid) and won't move on its own. Worth an overrides entry ("nanoid": "^3.3.19") alongside #384, or as a quick follow-up after it merges — happy to send that as a small separate PR once #384 is in, if useful.