chore: bump bumpalo to 3.11.1

Vec::into_iter() returned an iterator whose lifetime wasn't tied to
the Bump that allocated it, allowing use-after-free once the Bump
was dropped while the iterator was still alive (GHSA-f85w-wvc7-crwc,
medium). Only reachable here through wasm-bindgen's proc-macro
support, which uses bumpalo at compile time; the published
import_map crate doesn't depend on it. Lockfile-only bump.

Author: piscisaureus