chore(deps): bump @opentelemetry/core to 2.8.0 for CVE-2026-54285 (#6182)

W3CBaggagePropagator.extract() had no size limits on inbound baggage headers. Bumps the OTel core packages to 2.8.0 and the exporter/sdk-node packages to 0.219.0, which pin core 2.8.0 so no vulnerable copy is nested under them.

Author: waleedlatif1

apps/sim/package.json

@@ -80,15 +80,15 @@
     "@modelcontextprotocol/sdk": "1.29.0",
     "@monaco-editor/react": "4.7.0",
     "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/core": "2.7.1",
-    "@opentelemetry/exporter-logs-otlp-http": "0.217.0",
-    "@opentelemetry/exporter-metrics-otlp-http": "0.217.0",
-    "@opentelemetry/exporter-trace-otlp-http": "0.217.0",
-    "@opentelemetry/resources": "2.7.1",
-    "@opentelemetry/sdk-metrics": "2.7.1",
-    "@opentelemetry/sdk-node": "0.217.0",
-    "@opentelemetry/sdk-trace-base": "2.7.1",
-    "@opentelemetry/sdk-trace-node": "2.7.1",
+    "@opentelemetry/core": "2.8.0",
+    "@opentelemetry/exporter-logs-otlp-http": "0.219.0",
+    "@opentelemetry/exporter-metrics-otlp-http": "0.219.0",
+    "@opentelemetry/exporter-trace-otlp-http": "0.219.0",
+    "@opentelemetry/resources": "2.8.0",
+    "@opentelemetry/sdk-metrics": "2.8.0",
+    "@opentelemetry/sdk-node": "0.219.0",
+    "@opentelemetry/sdk-trace-base": "2.8.0",
+    "@opentelemetry/sdk-trace-node": "2.8.0",
     "@opentelemetry/semantic-conventions": "^1.32.0",
     "@radix-ui/react-avatar": "1.1.10",
     "@radix-ui/react-checkbox": "^1.1.3",