fix(deps): pin next to 16.4.1
Pins next to 16.4.1 in every manifest and lockfile for GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr. Opened by the CVE Alerts run.
Closes #16509
I moved next from 16.3.8 to 16.4.1 in web/package.json and examples/widget/package.json. 16.4.1 is the lowest 16.x release that fixes both GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr. The opal peer range >=14.0.0 already allows it, so I left it alone. The image-optimizer RCE (a bug in sharp, reached through Next's image optimizer) does not reach the production web app: web/next.config.js sets images.unoptimized: true, and web/package.json already requires sharp ^0.35.5, the fixed version the advisory names. The use cache RCE needs Cache Components, and neither web/next.config.js nor examples/widget/next.config.mjs turns on cacheComponents or useCache. I had no code-search tool in this run, so I checked the config files and every package.json I could find by reading them directly, but I could not search all source files for a "use cache" directive. My verdict is not affected in production, and the upgrade is worth merging anyway because both advisories are critical.