Bump auth0-spa-js for connected account updates (#923)

### Update to [email protected]

**Added**
- Retry when DPoP nonce is expired
[\#1445](auth0/auth0-spa-js#1445)
([adamjmcgrath](https://github.com/adamjmcgrath))
- Support mix of DPoP and Bearer in the fetcher
[\#1442](auth0/auth0-spa-js#1442)
([adamjmcgrath](https://github.com/adamjmcgrath))

**Fixed**
- Fix MRRT with default audience in worker
[\#1439](auth0/auth0-spa-js#1439)
([aridibag](https://github.com/aridibag))
- Fetcher: fix incorrect URL building when `baseUrl` is present
[\#1435](auth0/auth0-spa-js#1435)
([martinml](https://github.com/martinml))


[ESD-52771]:
https://auth0team.atlassian.net/browse/ESD-52771?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

Author: adamjmcgrath

package-lock.json

@@ -95,6 +95,6 @@
     "react-dom": "^16.11.0 || ^17 || ^18 || ^19"
   },
   "dependencies": {
-    "@auth0/auth0-spa-js": "^2.6.0"
+    "@auth0/auth0-spa-js": "^2.7.0"
   }
 }