Update nextjs-default e2e fixture lockfile for security advisories

[mustjab]

Description

Updates vulnerable dev/test npm dependencies in the nextjs-default export
e2e fixture lockfile. Follow-up to #29827, which covered the other five
lockfiles but not this one.

Updates

• next 15.5.18 -> 15.5.22
• postcss 8.5.14 -> 8.5.24
• nanoid 3.3.12 -> 3.3.16

Modified lockfile:

• js/web/test/e2e/exports/testcases/nextjs-default/package-lock.json

next 15.5.18 predates the 15.5.21 security release co-published with
16.2.11, so the fixture still resolved to a version affected by the
CVE-2026-64641..64649 advisory batch. postcss 8.5.14 is likewise inside the
affected range (<= 8.5.17) for CVE-2026-45623.

Note the fixture intentionally tracks the 15.x line (next: ^15.0.0 in
package.json, per #28547), so 15.5.22 — not 16.2.11 — is the correct target.

No package manifests or runtime source files are changed. The resolved
dependency set is unchanged (identical package keys before/after); the diff is
purely version/resolved/integrity.

Validation

• Regenerated with npm audit fix --package-lock-only against
  registry.npmjs.org; verified zero resolved URLs point anywhere else.
• npm audit --package-lock-only no longer reports next or postcss
  advisories; the diff is a balanced 46 insertions / 46 deletions.
• Confirmed package key sets are identical pre/post, so no dependency was
  added or dropped.
• Preserved libc metadata that npm >= 11.6 drops when rewriting lockfiles
  (the packages still declare it), keeping musl/glibc optional-dep selection
  intact for the @next/swc-linux-* binaries.

[Copilot]

Copilot wasn't able to review any files in this pull request.

Files not reviewed (1)

• js/web/test/e2e/exports/testcases/nextjs-default/package-lock.json: Generated file