Dependencies: drop unused and dead ones, close the remaining advisories

- yarn.lock refreshed within existing ranges for the open advisories.
- copy-webpack-plugin 11 -> 14 (serialize-javascript 7) and
  terser-webpack-plugin 5.6: build:www output is identical except four
  chunks where terser now emits `a ?? b` for `null == a ? b : a`.
- testcontainers (page-addresses, test-support) and devtron were never
  imported: removed (undici, @fastify/busboy, highlight.js went with
  them).
- The crypto-browserify webpack fallback was dead: build:www is
  byte-identical without it, so the fallback and the dependency are gone
  and a future `crypto` import fails the build instead of shipping a
  polyfill.
- braces resolves to @pezkuwi/braces 3.0.4, which limits nesting depth
  (CVE-2026-93687; no upstream release).

package.json

@@ -58,7 +58,6 @@
     "@types/react-dom": "^18.2.18",
     "@types/react-router-dom": "^5.3.3",
     "@types/store": "^2.0.5",
-    "devtron": "^1.4.0",
     "dnslink-cloudflare": "^3.0.0",
     "extensionless": "^1.9.6",
     "i18next-scanner": "^4.4.0",
@@ -105,6 +104,7 @@
     "@pezkuwi/x-textencoder": "^14.0.26",
     "@pezkuwi/x-ws": "^14.0.26",
     "@zondax/ledger-substrate": "1.1.1",
+    "braces": "npm:@pezkuwi/braces@^3.0.4",
     "typescript": "5.5.4"
   }
 }