fix: bump phoenix 1.6.17 and close leftover code-scanning alerts

[zreigz]

Phoenix 1.6.17 patches the HIGH channel-join DoS. Defer ESM-incompatible decode-uri-component 0.2.2 and react-router v7 MEDIUMs, and retry tool downloads so image scans can run.

Test Plan

Checklist

• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have added a meaningful title and summary to convey the impact of this PR to a user.
• I have added relevant labels to this PR to help with categorization for release notes.

[greptile-apps]

Confidence Score: 4/5

The PR should not merge until retried archive downloads are made restart-safe; the overbroad react-router scan exceptions should also be narrowed.

Findings

1.  Retries Corrupt Streamed Archives ▶
2.  React Router Ignores Too Broadly ▶

Summary

• Phoenix is consistently pinned to 1.6.17 across the umbrella and application manifests.
• Tool downloads now request HTTP failure handling and retries, but streamed retries cannot reliably recover interrupted archives.
• New vulnerability deferrals cover decode-uri-component and react-router; the react-router selectors are broader than their stated version-specific rationale.

_{Reviews (1) · Last reviewed commit: "fix: bump phoenix 1.6.17 and close lefto..."}