Fix serialize-javascript RCE vulnerability (replace mocha with vitest, upgrade deps)

[alexdima]

Problem

Dependabot alert #25: serialize-javascript 6.0.2 is vulnerable to RCE via RegExp.prototype.flags and Date.prototype.toISOString(). The earliest fixed version is 7.0.3.

The vulnerable dependency was introduced via two paths:

• mocha 10.8.2 → serialize-javascript 6.0.2
• webpack 5.x → terser-webpack-plugin → serialize-javascript 6.0.2

Solution

• Replace mocha with vitest — eliminates the mocha dependency path entirely. Vitest runs TypeScript directly, so test files no longer need to be compiled by tsc.
• Upgrade webpack 5.75 → 5.105 and webpack-cli 5.0 → 6.0
• Add npm overrides for serialize-javascript: ^7.0.3 — needed because terser-webpack-plugin still pins ^6.0.2
• Upgrade @types/node ^18 → ^22 (required by vitest 4.x)
• Add skipLibCheck to tsconfig (standard practice; vitest/vite types reference newer TS features)
• Exclude test files from tsc compilation (vitest handles them directly)
• Add vitest.config.ts with globals mode and an alias to resolve the emscripten-generated onig.js

Verification

$ npm audit
found 0 vulnerabilities

Resolves #25.