[fix] upgrade to Vite 2.6.11

[benmccann]

This includes two major fixes:

• fix: restrict static middleware fs access vitejs/vite#5361 (security - project root was always served ignoring allow setting)
• fix(ssr): ssrTransfrom with function declaration in scope, fix #4306 vitejs/vite#5376 (svelte internals broken by ssr transform)

This makes it so that allow actually has an effect. However, I haven't been able to set it to anything useful. If I say to only allow static serving from the static directory, Vite's static serving seems to be checking the root directory for a request to http://localhost:3000/ and failing, so it seems like there may be another bug there

[changeset-bot]

🦋 Changeset detected

Latest commit: 9e1eb8e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR