Add notes about observability being non-configurable for Sourcegraph Cloud - #234

…efresh) (#2109)

## What

Closes 20 of the 24 open [Dependabot
alerts](https://github.com/sourcegraph/docs/security/dependabot).

- `next` ^16.3.5 → ^16.3.8 (resolves to 16.4.3), `eslint-config-next` to
match, `sharp` ^0.35.4 → ^0.35.5
- `mermaid` ^11.16 → ^12.2, which brings `katex` 0.18 and `dompurify`
3.4.17 within its own declared ranges. `Mermaid.tsx` pins `layout:
dagre` and `look: classic` so diagrams render as they did under mermaid
11 (12 defaults to ELK layout and the "neo" look).
- `pnpm update --depth 20 brace-expansion source-map-js @grpc/grpc-js
dompurify`: the parents already allowed the patched versions, the
lockfile was just stale.
- `pnpm.overrides` for `toml` and `uuid`: their parents under
`contentlayer2` pin old majors, and `contentlayer2` has no newer
release. `toml` is only used for `+++` TOML frontmatter, which no page
has.
- `esbuild` ^0.25 as a devDependency: it is only a peer of
`contentlayer2` and `mdx-bundler`, which overrides do not reach.

| Alert | Severity | Package | Was → now | Fixed by |
|---|---|---|---|---|
| #304 | critical | next | 16.3.5 → 16.4.3 | bump |
| #308, #309, #310, #311, #319, #320 | high … low | next | 16.3.5 →
16.4.3 | bump |
| #318 | high | sharp | 0.35.4 → 0.35.5 | bump |
| #314 | high | source-map-js | 1.2.1 → 1.2.2 | lockfile refresh |
| #306, #305 | high, low | @grpc/grpc-js | 1.14.4 → 1.14.6 | lockfile
refresh |
| #282, #281 | high | toml | 3.0.0 → 4.3.0 | override |
| #303, #302 | medium | brace-expansion | 1.1.18 → 1.1.21, 5.0.9 →
5.0.12 | lockfile refresh |
| #194 | medium | uuid | 9.0.1 → 11.1.1 | override |
| #27 | medium | esbuild | 0.18.20 → 0.25.12 | devDependency |
| #316, #307 | low | dompurify | 3.4.15 → 3.4.17 | mermaid 12 + lockfile
refresh |
| #315 | low | katex | 0.16.47 → 0.18.10 | mermaid 12 |

#304 (RCE in `next/og` `ImageResponse`) is not exploitable here:
`src/app/api/og/[...path]/route.tsx` is `force-static` with
`dynamicParams = false`, so `ImageResponse` only ever sees page titles
from our own MDX at build time. #308 (SSRF in image optimization) does
not apply either; `next.config.js` has no `images` config.

## Not in this PR

- #234, #205 (`@opentelemetry/propagator-jaeger`,
`@opentelemetry/core`): the fix is OTel SDK 2.x, and `contentlayer2` →
`@effect-ts/otel` pins 1.x with a different `@opentelemetry/api` peer.
That tracing only runs inside `contentlayer2 build` and never reads a
request header. Dismiss as "vulnerable code is not actually used".
- #317 (`sprintf-js`), #312 (`braces`): withdrawn advisories with no
patched version. Dismiss.

## Test plan

- `pnpm install`: no new peer warnings (the `lucide-react` / React 19
one is pre-existing); `@opentelemetry/api` stays at 1.9.0
- `npx tsc --noEmit` clean against mermaid 12
- `pnpm run build`: 1494 static pages, OG images render as 1200×630 PNGs
- `pnpm run lint`: 0 errors, same 8 pre-existing warnings as `main`
- `pnpm start`, loaded `/admin/architecture` and
`/self-hosted/sourcegraph-nginx-mermaid` in headless Chrome: diagrams
render with the same dagre layout and classic look as mermaid 11
- Vercel preview build on this PR

---------

Co-authored-by: Amp <amp@ampcode.com>