Move vulnerable dependencies to patched versions

Clears the Dependabot alerts that can be fixed inside the ranges the
packages already declare, and drops one dependency nothing used.

- Transitive bumps within declared ranges: axios, bn.js, undici, tar,
  postcss, minimatch, picomatch, brace-expansion, fast-uri, js-yaml,
  lodash, ws, ip-address, node-forge, follow-redirects, form-data,
  http-proxy-middleware, launch-editor, nanoid, qs, rollup, shell-quote,
  websocket-driver, flatted, colord, json5, browserslist.
- styled-components 6.3.8 -> 6.5.3 (pulled by @pezkuwi/react-identicon and
  react-qr); 6.5 no longer pins postcss 8.4.49.
- Remove extract-loader from packages/extension: no webpack config or
  source references it, and it was the only path to babel 6,
  babel-traverse and browserslist 3.

What ships changes in two modules only. Built before and after, with
build paths normalised: content.js is byte-identical; page.js and
background.js differ in bn.js (5.2.2 -> 5.2.3); extension.js differs in
bn.js and axios (1.13.4 -> 1.20.0, reached only through
@zondax/ledger-substrate). Every other difference is the minifier
renaming identifiers. No @pezkuwi/* package, wasm-crypto or bip39 code
changes.

Left for a change in @pezkuwi/dev, where they come from: webpack-dev-server
4 and what it pulls (webpack-dev-middleware, qs 6.14, uuid 8, node-forge),
got 9 via gh-release, serialize-javascript 6 via terser-webpack-plugin,
minimatch 9.0.3 via @typescript-eslint 6. All build or local-dev tooling.
elliptic has no patched release; it arrives through crypto-browserify,
the webpack crypto fallback.

lint and test give the same result before and after this change; both
were already failing on main (41 lint errors, 19 of 61 tests), hidden by
continue-on-error in pr-any.yml.

packages/extension/package.json

@@ -32,7 +32,6 @@
     "buffer": "^6.0.3",
     "copy-webpack-plugin": "^11.0.0",
     "crypto-browserify": "^3.12.0",
-    "extract-loader": "^5.1.0",
     "file-loader": "^6.2.0",
     "html-loader": "^4.2.0",
     "path-browserify": "^1.0.1",