deps: bump liquidjs to 10.27.2 in apps/queue

[katsugtgz]

Updates liquidjs in apps/queue to address GHSA-m7fp-h3p4-hr49 (infinite loop in strip_html, CVSS 8.7) and GHSA-g357-x5c3-c72p.

Evidence:

• apps/queue/package.json pinned liquidjs@10.26.0, used at runtime for email template rendering (src/domain/process-drip.ts, apps/queue/src/domain/process-ongoing-sequences/)
• osv-scanner --lockfile=pnpm-lock.yaml reported both IDs for liquidjs@10.26.0
• updated version: 10.27.1

Validation:

• osv-scanner no longer reports liquidjs findings after the update
• pnpm install --filter queue resolves; liquidjs 10.27.1 installs and renders templates (new Liquid().parseAndRender(...) OK)
• tsup build output is identical to the base branch (the workspace TS2307 errors on @courselit/* packages are pre-existing on main and unchanged by this patch)

Scope: apps/queue/package.json and pnpm-lock.yaml only.

[katsugtgz]

Moved the pin to 10.27.2 to also cover GHSA-4r6h-5v86-94p3 (fixed in 10.27.2). osv-scanner reports no liquidjs advisories at that version. Sorry for the churn.