chore(deps): bump DOMPurify to 3.4.7 for CVE-2026-49978 (#28966)