fix(deps): take the fix for next GHSA-vcvr-r3jv-pc5j and dompurify GHSA-p98j-92pf-mc4p

OSV-Scanner on main's lockfile flags two rows: next 16.3.3 (CVSS 9.5,
fixed 16.3.6) and dompurify 3.4.13 (CVSS 2.3, fixed 3.4.16).

- apps/docs/package.json: the direct next pin moves 16.3.3 -> 16.3.6.
- pnpm-workspace.yaml: the existing dompurify override's target lifts
  ^3.4.13 -> ^3.4.16, selector unchanged at the 4.0.0 boundary; its
  advisory-history comment is extended in place.
- pnpm-lock.yaml: regenerated with pnpm 10.31.0 --lockfile-only. Only
  next, its nine @next/* packages and dompurify change version; the
  locked package count stays 1369.

No osv-scanner.toml exemption.

Claude-Session: https://claude.ai/code/session_01JAhu8u8QfBvRjVZDox7CP9
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

apps/docs/package.json

@@ -18,7 +18,7 @@
     "fumadocs-ui": "16.14.4",
     "lucide-react": "^1.31.0",
     "mermaid": "^11.16.0",
-    "next": "16.3.3",
+    "next": "16.3.6",
     "next-themes": "^0.4.6",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",