fix(observability-next): require next >=16.3.3 to resolve GHSA-p293-qw3h-jr36

[pkaeding]

Bumps the next devDependency range in @launchdarkly/observability-next off >=14.2.25, which Dependabot flags as vulnerable to the critical Next.js Windows RCE advisory.

Resolves Dependabot alert 1373 (GHSA-p293-qw3h-jr36 / CVE-2026-75604, CVSS 9.0).

• devDependencies.next: >=14.2.25 → ^16.3.3 (first patched 16.x release)
• No installed-version change: the root resolutions entry already pinned this workspace to next@16.3.3; the open-ended manifest range was what Dependabot saw
• peerDependencies.next left at >=14.2.25 — narrowing it would break consumers on Next 14/15; they should patch to 15.5.24+ / 16.3.3+ on their side

Implementation details

The alert is scoped to sdk/@launchdarkly/observability-next/package.json as a development dependency. #751 already bumped resolved versions to 15.5.24 / 16.3.3, but the lockfile still recorded the descriptor next: "npm:>=14.2.25" for this workspace, so the alert stayed open.

Testing: yarn install --immutable (lockfile consistent, only the descriptor line changed) and yarn turbo run build --filter @launchdarkly/observability-next succeed.

No deployment considerations — dev/build-time dependency range only.

Link to Devin session: https://app.devin.ai/sessions/1a350272431b44afa054899163c2b345
Open in Devin Desktop: https://app.devin.ai/desktop/session/1a350272431b44afa054899163c2b345?variant=devin
Requested by: @pkaeding

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring