deps: pin vitest's transitive vite to 8.0.16 in react & vue samples (#267)

The direct vite devDependency is already 8.0.16, but vitest@4.1.9 pulls its
own vite (8.0.8/8.0.9, range ^6||^7||^8), which is in the vulnerable range
for GHSA-fx2h-pf6j-xcff (high) and GHSA-v6wh-96g9-6wx3 (medium). Add a
`resolutions` entry forcing vitest/vite to 8.0.16 so only the patched version
resolves — same approach already used in the angular samples.

Dev/build-time only; not shipped in built apps. Verified: build and vitest
pass for all four samples.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ksroda-sa

samples/react/login-pkce/package.json

@@ -30,5 +30,8 @@
     "typescript": "6.0.3",
     "vite": "8.0.16",
     "vitest": "4.1.9"
+  },
+  "resolutions": {
+    "vitest/vite": "8.0.16"
   }
 }