fix: Next has a denial of service with server components (#16702)

The alerts regarding CVE-2025-55182, CVE-2025-55183, CVE-2025-55184 are
false-positive given Twenty only imported Next 15.2.4 via `react-emails`
as a devDependency, so it should have never made it to the production
build - it was reported due to yarn.lock file containing the version.
However, in order to remove the alerts, updated react-emails to 4.0.17
(latest patch in 4.0 minor release) and Next version it imports to
15.5.9.

[Dependabot Alert
337](https://github.com/twentyhq/twenty/security/dependabot/337),
[Dependabot Alert
343](https://github.com/twentyhq/twenty/security/dependabot/343),
[Dependabot Alert
344](https://github.com/twentyhq/twenty/security/dependabot/344).

Additionally, updated Next 14.2.33 to 14.2.35 to resolve another couple
alerts reported in CVE-2025-55184.

[Dependabot Alert
345](https://github.com/twentyhq/twenty/security/dependabot/345),
[Dependabot Alert
346](https://github.com/twentyhq/twenty/security/dependabot/346).

---------

Co-authored-by: Guillim <guillim@users.noreply.github.com>

packages/twenty-emails/package.json

@@ -21,10 +21,11 @@
     "@lingui/cli": "^5.1.2",
     "@lingui/swc-plugin": "^5.6.0",
     "@lingui/vite-plugin": "^5.1.2",
+    "@react-email/preview-server": "5.0.8",
     "@tiptap/core": "^3.4.2",
     "@types/react": "^19",
     "@types/react-dom": "^19",
-    "react-email": "4.0.6",
+    "react-email": "5.0.8",
     "vite-plugin-dts": "3.8.1"
   },
   "exports": {