Bump oxc-parser to >=0.90.0: 0.76.0 bindings lack build provenance

Would you consider bumping the `oxc-parser` dependency to `>=0.90.0`? At `0.76.0` its platform bindings publish without build provenance, which makes anything depending on componentize-js uninstallable under an installer that enforces provenance.

Filed here at the jco maintainers' suggestion — this started as [bytecodealliance/jco#1841](https://github.com/bytecodealliance/jco/issues/1841), and the reply was that the dependency needs updating here first.

The chain is `jco@1.27.0` → `@bytecodealliance/componentize-js@^0.22.0` → `oxc-parser@^0.76.0`. All 15 `@oxc-parser/binding-*` packages at `0.76.0` are missing build provenance attestations, while `oxc-parser` and `@oxc-project/types` at the same version have them.

It looks like a gap in one range rather than the norm: `@oxc-parser/binding-darwin-arm64` has attestations at `0.13.3`, none at `0.76.0`, and has them again from `0.90.0` through the current `0.143.0`. npm registry signatures are present throughout — build provenance specifically is what is missing.

Installers that enforce provenance and treat a loss of attestation as a downgrade refuse the install outright. It is not host-specific either: the resolver walks every optional binding, so all 15 have to be excluded individually to get past it, including the 13 for platforms a given project will never run.

Bumping to `>=0.90.0` would let componentize-js and jco install cleanly under those policies with no per-package exceptions.

Start by locating the oxc-parser dependency declaration in ComponentizeJS and inspect how its version is constrained. Verify the dependency update with an install configuration that enforces build provenance; done means componentize-js and its downstream jco installation no longer requires per-package provenance exceptions.

Written by the indexing model from the issue text.