fix: lock js-component-bindgen version

[andreiltd]

Pin bindgen to v2.11.0 and require --locked in CI. This fixes CI failures in other PRs.

Also, adapt to newer preview2-shim releases which no longer expose the host filesystem by default and prevents the splicer from reading wit paths.

[vados-cosmonic]

Hey @andreiltd was this break fresh in 2.16.0? In that case I may yank 2.16.0

[andreiltd]

Hey @vados-cosmonic it looks like this https://github.com/bytecodealliance/ComponentizeJS/actions/runs/35925632334/job/107399932778?pr=356 PR picked 2.12 and failed the same way.

[vados-cosmonic]

Welp that's unfortuntate -- sorry for the breakage here, the underlying dep update must have happened a while ago.

[andreiltd]

Hey @vados-cosmonic. No worries at all! I think another breaking change is in preview2-shim: bytecodealliance/jco@b3f7c6c.

We are passing the absolute hello.wit path into its wasm splicer and it no longer works. I will adapt to these changes here just wanted to give you heads-up this can break some workflows :)

[vados-cosmonic]

Ah yes, that breaking change was reflected in the versions of preview2-shim & jco-transpile IIRC but should not be broken in jco (the root preopen should be added back in for jco in particular when it runs)... Maybe I should have been more explicit in the release notes there.

[andreiltd]

I think the changes make sense and it is consistent with p3. I configured splicer to grant access to the wit directory rather than the entire host filesystem.