build: bump vitest past GHSA-5xrq-8626-4rwp; coverage-v8 everywhere

pnpm audit --prod --audit-level=critical (the new CI gate) failed on
vitest <3.2.6 (critical, arbitrary file read/execute via the UI
server). Bump vitest + @vitest/coverage-v8 in-range across the
workspace and add @vitest/coverage-v8 to every package that runs
vitest but lacked it (core-audit, core-cms, core-eslint, core-testing,
core-trpc, apps/cms, web-next, web-tanstack, turbo/generators) so
'pnpm test -- --coverage' works in every package. No compound test
scripts exist, so the vitest-last pass-through concern does not apply.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/core-consent/package.json

@@ -37,11 +37,11 @@
     "@repo/core-typescript": "workspace:*",
     "@testing-library/react": "^16.0.0",
     "@types/react": "^19.0.0",
-    "@vitest/coverage-v8": "^3.0.0",
+    "@vitest/coverage-v8": "^3.2.7",
     "jsdom": "^25.0.0",
     "payload": "^3.14.0",
     "react": "^19.0.0",
     "typescript": "^5.8.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.2.7"
   }
 }