Drop the dead crypto-browserify fallback; resolve braces to @pezkuwi/braces

elliptic (open advisories, no fixed version) came only through
crypto-browserify, the webpack fallback for node's crypto. Nothing in
the extension uses it: the only 'elliptic' in the built files is a word
in zxcvbn's dictionary. Without the fallback the chrome and firefox
builds contain the same modules with the same bodies; only webpack's
module ids and their order change (one browser-field-ignored module is
now resolved from a different request). A future crypto import now
fails the build instead of shipping a polyfill.

braces resolves to @pezkuwi/braces 3.0.4: braces 3.0.3, the latest upstream release, has an open advisory with no fixed version (CVE-2026-93687, stack exhaustion through deeply nested patterns); the fork rejects nesting deeper than maxDepth (500) with a SyntaxError.

package.json

@@ -59,6 +59,7 @@
   "resolutions": {
     "@types/react": "^18.3.3",
     "@types/react-dom": "^18.3.0",
+    "braces": "npm:@pezkuwi/braces@^3.0.4",
     "safe-buffer": "^5.2.1",
     "typescript": "^5.9.3"
   }