sharp pinned to 0.32.6 is affected by GHSA-f88m-g3jw-g9cj (high); bump to ^0.35.3

`@capacitor/assets@3.0.5` depends on `sharp` at an exact `0.32.6`:

```json
"dependencies": {
"sharp": "0.32.6"
}
```

That version falls inside [GHSA-f88m-g3jw-g9cj](https://github.com/advisories/GHSA-f88m-g3jw-g9cj) (high) — sharp's inherited libvips vulnerabilities, CVE-2026-33327, CVE-2026-33328, CVE-2026-35590 and CVE-2026-35591. The advisory covers `sharp < 0.35.0`, and the first patched release is `0.35.0`.

### Why the exact pin makes this awkward downstream

Because the dependency is pinned exactly rather than ranged, a consuming project cannot resolve it by updating — the only route is a package-manager override / `resolutions` entry forcing `sharp` above the range. That works, but it silently overrides a dependency the package deliberately pinned, which is not something a consumer should have to guess at.

### Relationship to #636

[#636](https://github.com/ionic-team/capacitor-assets/issues/636) already asks for a `sharp` bump, but from the install-failure angle and suggesting `0.34.1`. Worth noting that `0.34.x` is **also** inside this advisory's range, so it would not resolve the security side. `>= 0.35.0` addresses both, and would fix the `0.32.6` install/postinstall failures that several issues here describe as a side effect.

### Suggestion

Move the dependency to `^0.35.3` (current latest is `0.35.4`). For reference, Next.js 16.3.x now declares `sharp: ^0.35.3` as an optional dependency, so `0.35.x` is well exercised in the ecosystem.

Locate the package manifest containing the exact sharp 0.32.6 dependency and inspect any generated lockfiles. Update the dependency to ^0.35.3, then run the repository's install and test or build checks; done means the vulnerable pin is gone and installation succeeds without the reported sharp failures.

Written by the indexing model from the issue text.