chore(deps): upgrade example apps to clear security alerts

[Almaju]

Summary

Bumps the example apps' dependencies to clear the open dependabot security alerts. Both example apps are dev-only and not shipped to consumers of @mozilla/majc, but the alerts are still worth clearing for hygiene.

examples/react

• next 15.4.10 → 15.5.18 (latest 15.x backport). Clears the high-severity Next.js advisories (middleware bypass, server-component DoS, SSRF, etc.) that have 15.x fixes.
• postcss ^8 → ^8.5.10 (fixes GHSA-qx2v-qp2m-jg93 — XSS via unescaped </style>).
• Added overrides so next's nested postcss resolves to the fixed top-level version too.
• next-env.d.ts was regenerated by next build (15.5+ adds a routes.d.ts triple-slash reference — auto-managed by Next).

examples/iife

• package-lock.json regenerated. http-server@14.1.1 (already latest) now resolves to qs@6.15.2 and follow-redirects@1.16.0, both of which contain the fixed versions for the open advisories. lodash is no longer in the dep tree.

Not addressed by this PR

• Two medium-sev Next.js advisories (HTTP request smuggling in rewrites, unbounded next/image disk cache growth) are only patched in next 16.x. Bumping to 16 was tested and broke the example's Turbopack-based build because Turbopack doesn't honor the tsconfig.json paths alias for @mozilla/majc/*. Worth a follow-up but out of scope here.
• uuid advisory on the root lockfile (GHSA-w5hq-g745-h8pq) only affects v3()/v5()/v6(). This repo uses only v4() (single import in packages/core/src/store.ts), so the code path is not vulnerable. Recommend dismissing the alert manually.

Test plan

• npm install && npm test in repo root — 20/20 suites, 102/102 tests, 100% coverage
• npm run build in repo root — clean
• npm run lint in repo root — clean
• cd examples/react && npm install && npm audit — 0 vulnerabilities
• cd examples/react && npm run build — clean
• cd examples/iife && npm install && npm audit — 0 vulnerabilities