fix: eliminate the serialize-javascript vulnerability warning

[sodatea]

By switching to a fork of copy-webpack-plugin v5, so that we can
circumvent the issue in a non-semver-breaking way.

Fixes #5782

What kind of change does this PR introduce? (check at least one)

• Bugfix
• Feature
• Code style update
• Refactor
• Docs
• Underlying tools
• Other, please describe:

Does this PR introduce a breaking change? (check one)

• Yes
• No

Other information:

[yashha]

Thanks for the pr.
Do you know why there is a second copy-webpack-plugin here?

[sodatea]

It comes from vuepress, which is used to deploy the documentation.

[yashha]

Maybe an idea to make this a fixed version, because of security.
But I don't know.

[alexander-akait]

I strongly do not recommend do it

[yashha]

So maybe it would be better to do the Update and Migration?
https://github.com/webpack-contrib/copy-webpack-plugin/blob/master/CHANGELOG.md#-breaking-changes

[peteruithoven]

I strongly do not recommend do it

Why?
You're afraid that doing this quick fix will mean people won't work on properly updating / migrating?

[alexander-akait]

@peteruithoven We can do it in copy-webpack-plugin, it is not hard, I just ask why it is hard to update, but if it is require more time I can do patch release right now

[sodatea]

@evilebottnawi it's hard to update because Vue CLI allows users to tap into the copy-webpack-plugin configuration (I don't know how many would do this but there will surely be some). So updating it would break their apps.

I do plan to update it in the next major, but that would take another 2 to 3 months before being stable.
So the fork is used as a temporary fix to prevent the audit warning from scaring newcomers away.

It would certainly be better if a release can be made in the upstream package to address this issue.
I'll close this PR then.

[alexander-akait]

@sodatea let's do security release

[alexander-akait]

Done https://github.com/webpack-contrib/copy-webpack-plugin/releases/tag/v5.1.2

[sodatea]

@evilebottnawi Thanks!

[yashha]

Thanks! :)