Bump frontend @hocuspocus/provider to v4.2.0

Aligns the collaboration client with the server on the same v4 minor so the
two halves move in lockstep rather than only sharing a major. Provider v4.2.0
drops its ws dependency (the browser uses the native WebSocket), leaving ws as
dev-only tooling.

Author: akabiru

frontend/package-lock.json

@@ -91,7 +91,7 @@
     "@fullcalendar/resource-timeline": "^6.1.20",
     "@fullcalendar/timegrid": "^6.1.20",
     "@github/webauthn-json": "^2.1.1",
-    "@hocuspocus/provider": "^4.0.0",
+    "@hocuspocus/provider": "^4.2.0",
     "@hotwired/stimulus": "^3.2.2",
     "@hotwired/turbo": "^8.0.23",
     "@hotwired/turbo-rails": "^8.0.23",