fix(deps): bn.js 5.2.3+ and a lockfile that satisfies package.json (#2)

bn.js >= 5.0.0 < 5.2.3 (GHSA-378v-28hj-76wf) → `overrides` `bn.js ^5.2.3`; it resolves to 5.2.5.

Regenerating the lockfile also corrects it: `package.json` asks for `@pezkuwi/util` and `@pezkuwi/util-crypto` `^14.0.13`, while the committed lock pinned 14.0.11, which does not satisfy that range. Its root entry also still said version 1.0.0 while package.json says 1.0.1. The regenerated lock resolves @pezkuwi/util* 14.0.26 and @pezkuwi/wasm-* 7.5.21, the current releases inside the declared ranges. @pezkuwi/util-crypto now depends on `@pezkuwi/scure-sr25519` instead of `@scure/sr25519`. 16 version changes, 2 removed, 1 added; nothing outside the declared ranges.

package.json

@@ -66,5 +66,8 @@
     "@types/node": "^22.10.5",
     "@types/yargs": "^17.0.33",
     "typescript": "^5.9.3"
+  },
+  "overrides": {
+    "bn.js": "^5.2.3"
   }
 }