Security: vulnerable dependency image-size (CVE-2025-71329/71330) — maintained drop-in available

## Context

This package depends on npm **`image-size`**. Upstream is **archived** and the latest release (**2.0.2**) remains affected by:

- **CVE-2025-71329** — DoS via infinite loop (JXL/HEIF/JP2 zero-size boxes)
- **CVE-2025-71330** — DoS via infinite loop (ICNS zero entry length)

`npm audit fix` will **not** switch package names automatically.

## Maintained drop-in

Community MIT fork with the same public API as `image-size@2.0.2`:

- **npm:** https://www.npmjs.com/package/image-size-next (`image-size-next@2.1.0`)
- **GitHub:** https://github.com/lcf2212dev/image-size-next
- **Announcement:** https://github.com/lcf2212dev/image-size-next/blob/main/ANNOUNCE.md

Not affiliated with the original `image-size` maintainer — honest community fork only.

## Migration options

**A — Direct dependency**

```bash
npm install image-size-next
```

```diff
- import { imageSize } from 'image-size'
+ import { imageSize } from 'image-size-next'
```

**B — Force transitive resolution (npm 8.3+)**

```json
{
"overrides": {
"image-size": "npm:image-size-next@2.1.0"
}
}
```

## Ask

Happy to open a PR for **`birken-react-native-community-image-editor`** if useful. Thanks for maintaining open source.

首先检查 package.json，并搜索 issue 中所示的 imageSize 导入。确认维护中的 image-size-next 包是否保留当前 API，并检查项目现有的验证命令。只有在不破坏图像编辑器现有行为的情况下替换或覆盖存在漏洞的 image-size 依赖项，才算完成。

由索引模型根据 Issue 内容生成。