[HIGH] Bump image-size to 1.2.1

[OskarEichler]

Summary

• update Metro’s image-size lockfile entry from 1.1.1 to the fixed legacy release 1.2.1
• remain within the existing compatible 1.x range
• keep the change lockfile-only

Security impact

This removes GHSA-m5qc-5hw7-8vg7, an infinite-loop denial of service while processing malformed image data.

Two newer high-severity parser advisories (GHSA-5p2g-fcmc-qvqq for JXL/HEIF and GHSA-w3rx-r6r6-pgpr for ICNS) still have no patched release through image-size 2.0.2. The image-size repository is archived, so this PR intentionally makes the available remediation without claiming to clear those unresolved advisories.

Verification

• yarn install --frozen-lockfile --ignore-scripts
• yarn why image-size confirmed 1.2.1
• yarn audit no longer reports GHSA-m5qc-5hw7-8vg7
• yarn build
• community CLI asset handling: 4 suites, 18 tests passed
• git diff --check

[github-actions]

Warning

Missing Test Plan

Please add a "## Test Plan" section to your PR description. A Test Plan lets us know how these changes were tested.

Caution

Missing Changelog

Please add a Changelog to your PR description. See Changelog format