Drop the dead crypto-browserify fallback; resolve braces to @pezkuwi/braces

elliptic (open advisories, no fixed version) came only through
crypto-browserify, the webpack fallback for node's crypto. Nothing in
the extension uses it: the only 'elliptic' in the built files is a word
in zxcvbn's dictionary. Without the fallback the chrome and firefox
builds contain the same modules with the same bodies; only webpack's
module ids and their order change (one browser-field-ignored module is
now resolved from a different request). A future crypto import now
fails the build instead of shipping a polyfill.

braces resolves to @pezkuwi/braces 3.0.4: braces 3.0.3, the latest upstream release, has an open advisory with no fixed version (CVE-2026-93687, stack exhaustion through deeply nested patterns); the fork rejects nesting deeper than maxDepth (500) with a SyntaxError.

packages/extension/webpack.shared.cjs

@@ -152,7 +152,6 @@ module.exports = (entry, alias = {}) => ({
     },
     extensions: ['.js', '.jsx', '.ts', '.tsx'],
     fallback: {
-      crypto: require.resolve('crypto-browserify'),
       path: require.resolve('path-browserify'),
       stream: require.resolve('stream-browserify')
     }