chore(deps): refresh the dev dependencies and clear the audit

[mdesoto]

Supersedes #46. Dev dependencies only; the package has no runtime dependencies.

What changed

• Within range: eslint 10.4.0 → 10.11.0, typescript-eslint 8.59.4 → 8.70.0, jest 30.4.2 → 30.5.2, ts-jest 29.4.11 → 29.4.12, globals 17.6.0 → 17.12.0, @eslint/eslintrc 3.3.5 → 3.3.7, @types/node 22.19.19 → 22.20.4. Manifest floors moved to match.
• npm audit fix: brace-expansion to 1.1.21 (the four DoS advisories, high; this is what chore(deps-dev): Bump brace-expansion from 1.1.14 to 1.1.18 in the npm_and_yarn group across 1 directory #46 asked for at 1.1.18), @babel/core 7.29.7, @humanfs/node, baseline-browser-mapping. npm audit is empty.
• actions/checkout and actions/setup-node v6 → v7 in ci.yml, npm-publish.yml and update-blocklist.yml.

Held back

• typescript stays 5.9: 7 is outside typescript-eslint's peer range, and ts-node 10.9 (last release 2023) runs the generate and update-blocklist scripts; TypeScript 6's hard errors on deprecated options are a risk there that a dependency refresh should not take on.
• @types/node stays 22 while the test matrix still runs Node 20.

Verified

Run locally on Node 25.8 on the final tree:

npm install        exit 0
npm run generate   exit 0
npm run lint       exit 0, and rewrote nothing (the script runs with --fix)
npm test           43 passed
npm run build      exit 0
npm audit          found 0 vulnerabilities

Note on releasing

@quarg/burnerguard on npm is still 1.0.3 from 23 May. The June, July, August and September blocklists (#43, #44, #45, #47) are on main but bundled data ships only through a release, so consumers are running the May list. A 1.0.4 release after this merges would carry all four; the publish workflow checks that package.json matches the tag.