fix(deps): resolve 5 open Dependabot alerts across nested sharp/hono/fast-uri pins (#8096)

fast-uri (ajv transitive) was pinned below the host-confusion patches
(GHSA-v2hh-gcrm-f6hx, GHSA-4c8g-83qw-93j6). sharp and @hono/node-server
were already patched at the root, but miniflare/wrangler/@modelcontextprotocol-sdk
transitively pinned older, vulnerable copies nested under
packages/discovery-index and control-plane (GHSA-f88m-g3jw-g9cj,
GHSA-frvp-7c67-39w9). Added npm overrides to force the patched versions
everywhere, and aligned discovery-index's wrangler floor with root's so
the two dedupe into a single install instead of a private nested copy.

npm audit and Dependabot both report 0 open advisories on both lockfiles
after this change.

Author: JSONbored