build(deps): update dependency i18next-http-backend to v4.0.3 (#13472)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[i18next-http-backend](https://redirect.github.com/i18next/i18next-http-backend)
| [`4.0.2` →
`4.0.3`](https://renovatebot.com/diffs/npm/i18next-http-backend/4.0.2/4.0.3)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/i18next-http-backend/4.0.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/i18next-http-backend/4.0.2/4.0.3?slim=true)
|

---

### Release Notes

<details>
<summary>i18next/i18next-http-backend (i18next-http-backend)</summary>

###
[`v4.0.3`](https://redirect.github.com/i18next/i18next-http-backend/blob/HEAD/CHANGELOG.md#403)

[Compare
Source](https://redirect.github.com/i18next/i18next-http-backend/compare/v4.0.2...v4.0.3)

Security release. See advisory
[GHSA-9jhj-wvmw-cfx5](https://redirect.github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5).

- security: refuse a request URL that starts with `//` (or `\`) when the
`loadPath` / `addPath` template does not. With a template that puts
`{{ns}}` directly after a leading `/` (e.g. `/{{ns}}/{{lng}}.json`), an
`ns` value of `/evil.example` passed the per-value checks, because a
single `/` is allowed for nested namespaces, but it joined the
template's own `/` into `//evil.example/en.json`, a protocol-relative
URL that browsers send to another origin. The 4.0.2 `//` check looked at
the value only, so it missed this. The interpolated URL is now checked
as a whole. The default `/locales/{{lng}}/{{ns}}.json`, templates with
an origin, and protocol-relative CDN templates such as
`//cdn.example/{{lng}}/{{ns}}.json` are not affected and keep working.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

web/package.json

@@ -16,7 +16,7 @@
     "cn": "0.4.0",
     "i18next": "26.4.4",
     "i18next-browser-languagedetector": "8.2.1",
-    "i18next-http-backend": "4.0.2",
+    "i18next-http-backend": "4.0.3",
     "lucide-react": "1.57.0",
     "qrcode.react": "4.2.0",
     "react": "19.3.1",

web/pnpm-lock.yaml

@@ -44,8 +44,8 @@ importers:
         specifier: 8.2.1
         version: 8.2.1
       i18next-http-backend:
-        specifier: 4.0.2
-        version: 4.0.2
+        specifier: 4.0.3
+        version: 4.0.3
       lucide-react:
         specifier: 1.57.0
         version: 1.57.0(@types/react@19.3.0)(react@19.3.1)
@@ -2529,8 +2529,8 @@ packages:
   i18next-browser-languagedetector@8.2.1:
     resolution: {integrity: sha512-bZg8+4bdmaOiApD7N7BPT9W8MLZG+nPTOFlLiJiT8uzKXFjhxw4v2ierCXOwB5sFDMtuA5G4kgYZ0AznZxQ/cw==}
 
-  i18next-http-backend@4.0.2:
-    resolution: {integrity: sha512-oay62dIB2kL7+WHzoUXBjWfL3+mwijD3pQkQkIEaRLhy6kjXxUhrRenV0gInwlCASAaJaDy94+XvYizK+cAGdA==}
+  i18next-http-backend@4.0.3:
+    resolution: {integrity: sha512-B5GJysCsJwqiDQRpUcikWsut82Vmekix58WIyiCpYtxaZ/wY8kwJCicMRvVcMoIa1x84siiRl5vBt6iCBVO6zg==}
     engines: {node: '>=18'}
 
   i18next@26.4.4:
@@ -6513,7 +6513,7 @@ snapshots:
     dependencies:
       '@babel/runtime': 7.29.7
 
-  i18next-http-backend@4.0.2: {}
+  i18next-http-backend@4.0.3: {}
 
   i18next@26.4.4(@typescript/typescript6@6.0.2):
     optionalDependencies: