fix(website): bump react-router to ^7.17.0 to clear 6 CVEs

The marketing site (separate npm project from the pnpm monorepo) pinned
react-router ^7.6.2 with the lockfile resolved at 7.13.1, leaving 6 open
Dependabot alerts (4 high, 2 moderate): unauth RCE via vendored
turbo-stream TYPE_ERROR deserialization (GHSA-49rj-9fvp-4h2h), two DoS
(GHSA-rxv8-25v2-qmq8, GHSA-8x6r-g9mw-2r78), RSC redirect XSS
(GHSA-8646-j5j9-6r62), prerender Location XSS (GHSA-f22v-gfqf-p8f3), and
protocol-relative open redirect (GHSA-2j2x-hqr9-3h42).

Bump the floor to ^7.17.0 (latest 7.x, same major) and refresh the lock.
`npm audit` now reports 0 vulnerabilities; `npm run build` passes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ersinkoc

website/package-lock.json

@@ -16,7 +16,7 @@
     "lucide-react": "^0.513.0",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
-    "react-router": "^7.6.2",
+    "react-router": "^7.17.0",
     "tailwind-merge": "^3.3.0",
     "zustand": "^5.0.5"
   },