fix: refresh vulnerable transitive dependencies in lockfile

[yotatameguchi-boop]

The committed lockfile resolves three dependencies with published security advisories. Refresh their resolutions within the existing dependency ranges so repository installs using npm ci no longer select those versions:

• bn.js: 4.12.0 → 4.12.5 (production dependency via asn1.js; GHSA-378v-28hj-76wf, infinite loop).
• brace-expansion: 5.0.9 → 5.0.12 (development dependency via ESLint/minimatch; GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p, denial of service).
• serialize-javascript: 7.1.1 → 7.1.2 (development dependency via Mocha; GHSA-gfhx-hw2g-v5hg, XSS).

These are dependency-audit findings; this change does not claim an exploitable path through web-push. It updates only package-lock.json, with no dependency range or application code changes. Published-library consumers resolve dependencies from package.json, so this refresh primarily protects repository/CI installations that use the lockfile.

Validation on Node.js 24.18.1:

• npm ci --ignore-scripts: audit reports 0 vulnerabilities (previously 3).
• npm run lint: passed.
• npx mocha --ui tdd 'test/test-*.js' test/testSetGCMAPIKey.js test/testSendNotification.js: 131 passing, including encryption/decryption, VAPID, CLI and HTTPS send/receive tests.
• git diff --check: passed.

Browser integration tests were not run locally.

Reachability follow-up

Local checks distinguish the vulnerable dependencies from exploitation through web-push:

• The original bn.js@4.12.0 hangs on new BN(1).maskn(0).toString(10); the isolated child process was terminated after 1.5 seconds. The updated version returns 0. There are no maskn/imaskn calls in web-push or its ASN.1 use. Injecting the old BN export and trapping those methods during both VAPID encodings and both request-generation encodings completed with zero calls. No remote trigger through the checked web-push paths was identified.
• The original brace-expansion@5.0.9 throws a stack-overflow RangeError for deeply nested brace input; 5.0.12 returns normally. This is a development dependency and no notification-input path imports it.
• The original serialize-javascript@7.1.1 emits an unescaped closing script tag for the advisory's crafted function; 7.1.2 does not. The notification API does not import this package, and Mocha's relevant use serializes worker options rather than generating HTML. Browser execution was not tested.

These results support treating this PR as dependency hygiene for repository installations, not a demonstrated remote-exploitation fix for the notification API. The checks are scoped and do not establish that all possible downstream integrations are safe.