Update nextjs-default e2e fixture lockfile for security advisories (#29926)

## Description

Updates vulnerable dev/test npm dependencies in the `nextjs-default`
export
e2e fixture lockfile. Follow-up to #29827, which covered the other five
lockfiles but not this one.

## Updates

- `next` `15.5.18` -> `15.5.22`
- `postcss` `8.5.14` -> `8.5.24`
- `nanoid` `3.3.12` -> `3.3.16`

Modified lockfile:

- `js/web/test/e2e/exports/testcases/nextjs-default/package-lock.json`

`next` 15.5.18 predates the `15.5.21` security release co-published with
`16.2.11`, so the fixture still resolved to a version affected by the
CVE-2026-64641..64649 advisory batch. `postcss` 8.5.14 is likewise
inside the
affected range (`<= 8.5.17`) for CVE-2026-45623.

Note the fixture intentionally tracks the `15.x` line (`next: ^15.0.0`
in
package.json, per #28547), so `15.5.22` — not `16.2.11` — is the correct
target.

No package manifests or runtime source files are changed. The resolved
dependency set is unchanged (identical package keys before/after); the
diff is
purely `version`/`resolved`/`integrity`.

## Validation

- Regenerated with `npm audit fix --package-lock-only` against
`registry.npmjs.org`; verified zero `resolved` URLs point anywhere else.
- `npm audit --package-lock-only` no longer reports `next` or `postcss`
  advisories; the diff is a balanced 46 insertions / 46 deletions.
- Confirmed package key sets are identical pre/post, so no dependency
was
  added or dropped.
- Preserved `libc` metadata that npm >= 11.6 drops when rewriting
lockfiles
(the packages still declare it), keeping musl/glibc optional-dep
selection
  intact for the `@next/swc-linux-*` binaries.

Author: mustjab