fix: upgrade next to 16.3.3 across core and templates (#17932)

## Summary
- Bumps `next` and related `@next/*` packages from 16.3.0 to 16.3.3 in
core, `test`, and all workspace templates
- Addresses the [August 2026 Next.js security
release](https://nextjs.org/blog/august-2026-security-release), which
patches:
- An unauthenticated RCE in the Image Optimization API when optimizing
attacker-controlled AVIF images (Critical)
- An unauthenticated RCE on Windows-hosted servers using both Pages
Router and App Router without Cache Components (Critical)

package.json

@@ -146,7 +146,7 @@
     "@axe-core/playwright": "4.11.0",
     "@clack/prompts": "1.2.0",
     "@libsql/client": "0.14.0",
-    "@next/bundle-analyzer": "16.3.0",
+    "@next/bundle-analyzer": "16.3.3",
     "@payloadcms/db-postgres": "workspace:*",
     "@payloadcms/eslint-config": "workspace:*",
     "@payloadcms/eslint-plugin": "workspace:*",
@@ -186,7 +186,7 @@
     "lint-staged": "15.2.7",
     "minimist": "1.2.8",
     "mongoose": "9.9.2",
-    "next": "16.3.0",
+    "next": "16.3.3",
     "node-gyp": "12.3.0",
     "open": "^10.1.0",
     "p-limit": "^5.0.0",