`esbuild` and `@opentelemetry/core` vulnerabilities

[G-Rath]

The latest version of netlify-cli is pulling in GHSA-8988-4f7v-96qf (@opentelementry/core) and GHSA-g7r4-m6w7-qqqr (esbuild):

❯ npm ls @opentelemetry/core
└─┬ netlify-cli@26.2.0
  └─┬ @netlify/blobs@10.7.9
    └─┬ @netlify/otel@6.0.3
      ├── @opentelemetry/core@2.7.1
      ├─┬ @opentelemetry/resources@2.7.1
      │ └── @opentelemetry/core@2.7.1 deduped
      └─┬ @opentelemetry/sdk-trace-node@2.7.1
        ├── @opentelemetry/core@2.7.1 deduped
        └─┬ @opentelemetry/sdk-trace-base@2.7.1
          └── @opentelemetry/core@2.7.1 deduped

❯ npm ls esbuild
└─┬ netlify-cli@26.2.0
  ├─┬ @netlify/edge-bundler@14.10.3
  │ └── esbuild@0.28.0
  └─┬ @netlify/zip-it-and-ship-it@14.7.1
    └── esbuild@0.28.0 deduped

It looks like esbuild was bumped to v0.28.1 for @netlify/edge-bundler and @netlify/zip-it-and-ship-it in v15.0.1 which #8322 is trying to land, which'd resolve GHSA-g7r4-m6w7-qqqr

For @opentelementry/core, that requires a new version of @netlify/otel to be released that bumps the version to v2.8.0 higher.

Note that #8306 has been opened in an attempt to address this but does not do so correctly

[G-Rath]

@serhalp could this be looked at? there's also now a sharp vuln being pulled in by @netlify/images (#8351)