Cherry-pick ghsa commits to canary (#93614)
## What?
Includes the changes from 16-2.
---------
Co-authored-by: JJ Kasper <jj@jjsweb.site>
Co-authored-by: Josh Story <story@hey.com>
Co-authored-by: Zack Tanner <1939140+ztanner@users.noreply.github.com>
Co-authored-by: Benjamin Woodruff <benjamin.woodruff@vercel.com>
