Update markdown cicero

[clementbiron]

Running npm ci in downstream collections now fails — see for example the user-rights-declarations CI run #26438517995:

npm error Missing: @accordproject/concerto-cto@ from lock file
npm error Missing: @accordproject/concerto-util@ from lock file

The engine pulls in a broken concerto-core version transitively:

@opentermsarchive/engine
└── @accordproject/markdown-cicero@0.16.26
    └── @accordproject/concerto-core@3.19.8   ← broken

Upstream published concerto-core@3.19.8 (now flagged as deprecated) with local filesystem paths instead of registry versions in its dependencies:

"@accordproject/concerto-cto": "file:../concerto-cto",
"@accordproject/concerto-util": "file:../concerto-util"

The packaging mistake comes from accordproject/concerto#945, which leaked monorepo paths into the published artifact.

The bug has been present since concerto-core@3.19.8 was released in November 2024 but stayed latent: older npm versions silently resolved the file:.. references via dedup links to the top-level concerto-cto and concerto-util packages already in the tree. Recent npm releases on GitHub Actions runners tightened lock-file validation, and npm ci now refuses to proceed.

Bumping @accordproject/markdown-cicero to ^0.18.0 removes the problematic branch entirely: from 0.18.0 onwards, this package no longer declares any concerto-core dependency.