Bump deps

[tharropoulos]

Change Summary

• bump the Vitest stack (vitest, @vitest/browser, @vitest/ui) and refresh the lockfile to move vulnerable transitive deps off older vite and flatted paths.
• upgrade webpack to 5.106.2 to pull in a newer terser-webpack-plugin and remove the serialize-javascript dependency path from the build toolchain.
• remove unused mocha and mocha-junit-reporter dev dependencies after confirming the repo’s active test workflow uses vitest.
• regenerate the browser build artifacts in dist/ after the dependency updates and verify CommonJS, ESM import, and browser-global loading still work.
• refresh the lockfile with audit-driven dependency cleanup to prune obsolete transitive packages and reduce the remaining advisory count.

PR Checklist

• I have read and signed the Contributor License Agreement.