fix(dep): Update to eval@0.5.0 and @bytecodealliance/jco@1.17.9 (backport to v3)

[harmony7]

This PR updates the @bytecodealliance/weval dependency to 0.5.0 and the @bytecodealliance/jco dependency to 1.17.9. The fix npm audit suggests is a downgrade to 3.22.4 (from before weval was added), so users have no good way to clear the finding on their side.

This is a backport of #1601 to v3.

Unlike v4, this branch actually linked to @bytecodealliance/jco@1.7.0. I've bumped to @bytecodealliance/jco@1.17.9, the same version used by v4, and verified that built binaries are identical before and after this bump.

Impact

decompress is only used by weval's getWeval(). That runs when the CLI first does an AOT compilation, which is now the default in 4.0.0. It unpacks the weval binary downloaded from the bytecodealliance/weval GitHub releases into node_modules. It runs on the developer's machine or in CI, not inside the Compute sandbox. Exploiting the advisory would need a malicious archive to be served at that download URL, so the practical risk is low. The audit finding is still critical, and it affects every downstream project.

[zkat]

this is the wrong target branch. We'll need to create a separate release branch that forks off pre-3.x and apply this there instead. I can take care of that.