fix: update dependencies to resolve critical security vulnerabilities

[theluckystrike]

Summary

• Update webpack-bundle-analyzer from ^4.10.2 to ^5.2.0 (resolves ws DoS vulnerability)
• Update webpack from ^5.91.0 to ^5.105.4 (resolves XSS and SSRF vulnerabilities)
• Regenerate package-lock.json to pick up patched transitive dependencies

Resolved Vulnerabilities (21 total)

Advisory	Package	Severity
GHSA-3h5v-q93c-6h6q	ws <8.17.1 — DoS via HTTP headers	High
GHSA-5c6j-r48x-rmvq	serialize-javascript — RCE	High
GHSA-95m3-7q98-8xr5	sha.js — type check bypass	Critical
GHSA-5gfm-wpxj-wjgq	node-forge — ASN.1 desync	Critical
GHSA-65ch-62r8-g69g	node-forge — OID truncation	Critical
GHSA-3xgq-45jj-v275	cross-spawn — ReDoS	High
GHSA-rp65-9cf3-cjxr	nth-check — RegExp complexity	High
GHSA-v6h2-p8h4-qcjw	brace-expansion — ReDoS	High
GHSA-4vvj-4cpr-p986	webpack — DOM Clobbering XSS	Moderate
GHSA-8fgc-7cc6-rx7x	webpack — SSRF via buildHttp	Moderate
GHSA-38r7-794h-5758	webpack — SSRF via HttpUriPlugin	Moderate
GHSA-968p-4wvh-cqc8	@babel/helpers — inefficient RegExp	Moderate
GHSA-2g4f-4pwh-qvx6	ajv — ReDoS	Moderate

Reduces total npm audit vulnerabilities from 67 to 46. Remaining vulnerabilities are in deep transitive dependencies of devDependencies (gulp-imagemin, npm-check-updates, gulp-htmlmin) and require breaking major version updates or have no upstream fix available.

Note: All vulnerabilities (both resolved and remaining) are in devDependencies and do not affect the runtime extension code shipped to users.

Test Plan

• Verify npm install completes without errors
• Verify npm audit shows reduced vulnerability count
• Verify npm run build:prod:chrome builds successfully

[github-actions]

This project does not accept pull requests. Please use issues to report bugs or suggest new features.