chore: bump @dcl/content-validator to 7.4.2

[LautaroPetaccio]

bumps @dcl/content-validator from 7.3.3 to 7.4.2.

• 7.4.2 — enforce content/pointer binding for third-party items: a reused third-party wearable proof can no longer be deployed as an emote at the wearable's pointer, and third-party wearable/emote proofs must commit id/content/data (or emoteDataADR74). (core-libs #57)
• 7.4.1 — require a scene's display.navmapThumbnail to be a relative embedded-content path (stored-XSS hardening).

no api changes: only the content-validator entry changed in package.json/yarn.lock (same transitive deps). catalyst typecheck and the unit suite (359) pass against 7.4.2.

note: test/integration/syncronization/bootstrapping.spec.ts is a pre-existing flaky sync suite (bootstrap fetch/ENOENT races in CI) unrelated to this bump — the suite stubs the validator. it's being stabilized in a dedicated PR; if it flakes here, re-run CI.

[decentraland-bot]

Reviewed the dependency bump and lockfile update.

Findings

• No P0/P1 issues found.
• Security review: no secrets, new input surfaces, auth changes, or lockfile expansion found. The bumped validator is on the deployment validation path, so the stricter behavior is consumer-visible, but the API shape/status-code contract remains compatible and the PR body documents the intended validation hardening.
• Consumer impact: valid deployments should remain compatible; invalid third-party item proofs and non-relative scene navmap thumbnails may now be rejected as intended.

CI: latest checks are passing.

---

Reviewed by Jarvis 🤖 · Requested by Lautaro Petaccio (<@U025WCHLMN3>) via Slack