Lock sharp and source-map-js at their patched releasesfix/dependency-audit

The dependency audit fails since two advisories were published against
packages that Next.js brings in:

- sharp before 0.35.5, a vulnerability in the librsvg it bundles
  (GHSA-wq5f-xc86-pv6w);
- source-map-js before 1.2.2, a denial of service through indexed
  source-map sections (GHSA-68fv-2mgg-jv7q).

Next.js asks for sharp ^0.35.4 and PostCSS for source-map-js ^1.2.1, so the
patched releases were already allowed and only the lockfile held the old
ones. The lockfile now resolves sharp 0.35.5, with its platform packages,
and source-map-js 1.2.2. No other package changes, and no override or
ignored advisory is added.

0 files changed, 0 insertions, 0 deletions