fix(deps): resolve dependabot security alerts

[lwshang]

Summary

• wasmtime: bump to 43.0.2
• frontend dependencies: fix security vulnerabilities in the React example (vite bump to 6.4.2)
• Cargo.lock: run cargo update to pull in latest compatible versions
• Dismiss gix-date alert: alert feat: initial skeleton for build command #7 (CVE-2026-0810) is dismissed as tolerable risk — cargo-generate (the only consumer) pins gix-config ~0.48 which transitively requires gix-date ^0.11.1; no fix is available until cargo-generate updates its gix dependency chain
• postcss: bump to 8.5.13 in docs-site — fixes GHSA-qx2v-qp2m-jg93 (XSS via unescaped </style>); supersedes Dependabot PR chore(deps): bump postcss from 8.5.6 to 8.5.13 in /docs-site #540
• yaml: bump top-level to 2.8.3 in docs-site — partially fixes GHSA-48c2-rrv3-qjmp (stack overflow via deeply nested collections)

Why the yaml fix is incomplete

The remaining vulnerable instance is node_modules/yaml-language-server/node_modules/yaml@2.7.1, a nested install scoped to yaml-language-server. The dependency chain is:

@astrojs/check >=0.9.3
  → @astrojs/language-server >=2.14.0
    → volar-service-yaml@0.0.70  (latest release)
      → yaml-language-server@~1.20.0
        → yaml@2.7.1  (exact pin)

volar-service-yaml@0.0.70 is the latest available version and still pins yaml-language-server@~1.20.0, which pins yaml at exactly 2.7.1. There is no non-breaking upstream fix: npm audit fix --force would downgrade @astrojs/check to 0.9.2, which is the wrong direction. The nested install will resolve once volar-service-yaml ships a release that adopts a newer yaml-language-server.

Why example lock files are excluded from git

examples/ contains standalone frontend projects that each have their own package-lock.json (or equivalent). Committing these lock files causes Dependabot to open security alerts for every transitive JS dependency across all examples — but since the examples are templates/demos rather than deployed applications, pinning their transitive deps in git provides little value and creates significant noise.

The .gitignore rules added in this PR exclude:

• examples/**/package-lock.json
• examples/**/yarn.lock
• examples/**/pnpm-lock.yaml

The example package.json files (which specify direct dependencies) are still tracked, so the examples remain usable and reproducible for their intended purpose.

Test plan

• cargo build --bin icp succeeds
• cargo test passes
• cargo clippy clean