build: resolve npm audit advisories

[antobinary]

What

Npm audit fixes

Applied in two passes:

1. npm audit fix — every non-breaking resolution. This alone cleared both
   criticals (shell-quote, websocket-driver) and most highs.
2. The two major upgrades npm could not apply on its own:
   • copy-webpack-plugin ^12.0.2 -> ^14.0.0 (clears serialize-javascript)
   • webpack-dev-server ^4.15.1 -> ^6.0.0 (clears sockjs, uuid, and the
     webpack-dev-server source-disclosure advisory)

Why this one matters more than its diff suggests

Every new plugin generated from this template inherits its dependency versions.
Leaving webpack-dev-server 4 and copy-webpack-plugin 12 here means each new
plugin starts life with both criticals and ~20 highs already present. Landing
this stops the problem being reintroduced.

Scope

Everything changed here is build tooling. None of it ships in the bundle — a
plugin deploys a single bundled JS file, and these packages exist only to
produce it. The value is build-time supply-chain integrity rather than a runtime
exposure.

Testing

Against Node 24.20.0:

• npm ci — PASS
• npx tsc — PASS
• npm run lint — PASS
• npm run build-bundle — PASS
• npm audit — 0 vulnerabilities

webpack-dev-server 6 is a major bump with breaking config changes, and a
successful production build does not exercise the dev-server path at all. It was
verified separately by starting the dev server and confirming the custom
setupMiddlewares / devServer.app.get('/manifest.json') route still answers
200 with the correct body. That matters more here than elsewhere, since the
template's webpack config is the one every plugin copies.

Notes for review

The package-lock.json diff is large because the whole dev dependency tree was
re-resolved. package.json is the meaningful diff: two version bumps.

[imdt-claudiop]

Approved.

Same remediation as bigbluebutton/bbb-plugin-picture-in-picture#45, which is already merged: copy-webpack-plugin 12 to 14 and webpack-dev-server to 6.

Verified on Node 24.9.0:

• npm audit on the base branch reports 40 vulnerabilities (21 high, 2 critical), and 0 on this branch
• npm install clean, no package-lock.json drift
• npx tsc and npm run lint pass
• npm run build-bundle produces dist/<plugin-name>.js
• npm start still serves. This repo's webpack.config.js already uses setupMiddlewares, so the dev-server major upgrade needs no config change here, unlike the reference PR which had to migrate it.