deps: upgrade to Astro 7 and Starlight 0.42; fix quickstart go.sum (#463)

* docs: run go mod tidy in the quickstart

The quickstart program imports echo/v5/middleware, which needs
golang.org/x/time. `go get` of the root package does not record it, so
`go run main.go` failed on a clean machine with a missing go.sum entry.

* deps: upgrade to Astro 7 and Starlight 0.42

Clears all 21 open Dependabot alerts on site/package-lock.json, including
the critical astro advisory (fixed in 7.2.8) and high-severity js-yaml,
nanoid, postcss, sharp, smol-toml and svgo advisories. `npm audit` reports
0 vulnerabilities.

- astro 6.4.7 -> 7.3.5, @astrojs/starlight 0.40.0 -> 0.42.4 (requires
  astro 7.2.10+), @astrojs/markdown-remark 7.2.0 -> 7.3.1, sharp
  0.35.1 -> 0.35.5.
- The lockfile is regenerated: npm could not resolve the Astro 7 peer
  range from the old tree.

No site code changes were needed. Starlight 0.42's new mobile menu markup
does not affect our CSS or component overrides (Banner, Footer, Search).

Author: vishr