security: clear koa High alert by bumping nx 22.5.4 → 22.7.5 (#21396)

## What

Clears the High `koa` alert (GHSA-7gcc-r8m5-44qm) — via a parent bump,
**no resolution**.

`koa@3.0.3` was a deep transitive of the module-federation build
tooling:
`koa` ← `@module-federation/dts-plugin@0.21.4` ←
`@module-federation/enhanced@0.21.4`, pulled via **two** paths —
`@nx/module-federation@22.5.4` (directly) and `@module-federation/node`
(pinning the old `enhanced@0.21.x` line).

`@module-federation/dts-plugin` 2.x dropped koa, so the fix moves both
paths onto the 2.x line:

- bump `nx` + `@nx/{jest,js,react,storybook,vite,web}` **22.5.4 →
22.7.5** (minor): `@nx/module-federation@22.7.5` uses
`@module-federation/enhanced@^2.3.3`
- refresh `@module-federation/node` within its existing `^2.7.21` range
→ 2.7.44, which uses `@module-federation/enhanced@2.5.1`

Result: `@module-federation/enhanced` + `dts-plugin` collapse to 2.5.1,
and **koa is gone from the tree entirely** (net −309 lockfile lines
after dedup).

## Verification (nx is the monorepo task runner — verified broadly)
- `nx build` + `typecheck`: twenty-shared, twenty-ui, twenty-front ✅
- `nx typecheck twenty-server` ✅
- `nx test twenty-shared` ✅
- `yarn install --immutable` clean

The only `package.json` change is the nx version bump; everything else
is lockfile.

package.json

@@ -1,18 +1,18 @@
 {
   "private": true,
   "devDependencies": {
-    "@nx/jest": "22.5.4",
-    "@nx/js": "22.5.4",
-    "@nx/react": "22.5.4",
-    "@nx/storybook": "22.5.4",
-    "@nx/vite": "22.5.4",
-    "@nx/web": "22.5.4",
+    "@nx/jest": "22.7.5",
+    "@nx/js": "22.7.5",
+    "@nx/react": "22.7.5",
+    "@nx/storybook": "22.7.5",
+    "@nx/vite": "22.7.5",
+    "@nx/web": "22.7.5",
     "@types/react": "^18.2.39",
     "@types/react-dom": "^18.2.15",
     "@yarnpkg/types": "^4.0.0",
     "concurrently": "^8.2.2",
     "http-server": "^14.1.1",
-    "nx": "22.5.4",
+    "nx": "22.7.5",
     "oxfmt": "0.50.0",
     "tsx": "^4.17.0",
     "verdaccio": "^6.3.1"