Patch frontend dependencies and image packages blocking Security CI

[quarj0]

Current Security CI on PR #308 fails because the frontend dependency graph and verification-portal image contain newly reported high/critical vulnerabilities.

Affected versions reported by the current scan:

• Browserslist <=4.28.6; patched in 4.28.7 (Dependabot alerts [IC-080] Apply a strict CSP and remove unsafe script/style requirements from all web apps. #164 and build(frontend): standardize on root workspace lockfile #165).
• js-yaml 4.3.1; patched in 4.3.2.
• Next.js 16.3.0; patched in 16.3.3.
• Sharp 0.35.0; patched in 0.35.4.
• Alpine libcrypto3/libssl3 3.5.7-r0; patched in 3.5.8-r0.

Acceptance: update all five frontend applications and the lockfile, refresh the image packages, pass frontend CI and dependency/container security scans, and complete review before merging.

Evidence: https://github.com/quarj0/IdentityCore/actions/runs/34545441420