fix(security): patch HIGH CVEs flagged by Trivy

Three HIGH-severity findings appeared in the latest Trivy scan due to
new vuln-database entries; none are caused by the previous Cloudflare
removal commit but they block the Security workflow.

devalue@5.7.1 (CVE-2026-42570) - DoS via sparse-array deserialization.
Astro hasn't bumped its devalue range yet, so override it to >=5.8.1
in packages/site/package.json.

Docker base image - bump node:26-slim digest to the latest published
build (sha256:a12126cf...) and add an explicit apt-get upgrade -y
step so libcap2 (CVE-2026-4878) and libsystemd0 (CVE-2026-29111) are
patched from Debian security regardless of base-image freshness.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: dorlugasigal

Dockerfile

@@ -1,7 +1,8 @@
-FROM node:26-slim@sha256:424cafd2a035ed2b2d74acc3142b68b426fb62a47742c80a75e7117db02d6b30
+FROM node:26-slim@sha256:a12126cfec3cd85577cb573fa86a588018721098c18fe67fe1a554cc25a1a6a5
 
-RUN apt-get update && apt-get install -y \
-    python3 make g++ \
+RUN apt-get update \
+    && apt-get upgrade -y \
+    && apt-get install -y python3 make g++ \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app

packages/site/package-lock.json

@@ -16,7 +16,8 @@
   },
   "overrides": {
     "yaml": ">=2.8.3",
-    "fast-uri": ">=3.1.2"
+    "fast-uri": ">=3.1.2",
+    "devalue": ">=5.8.1"
   },
   "dependencies": {
     "@astrojs/check": "^0.9.8",