chore(deps): upgrade @wordpress/scripts to 33 and refresh the lockfile (#235)

Every open Dependabot alert is npm, in package-lock.json, and transitive
through @wordpress/scripts. None are Composer, so the ranges pinned in
#232 are not involved.

Two changes, no overrides:

1. Lift the version cap. .github/dependabot.yml held @wordpress/scripts
   below 32.3.0 and @wordpress/e2e-test-utils-playwright below 1.47.0,
   because those releases pointed their package "exports" at TypeScript
   source that the Playwright runner cannot load. Upstream reverted that:

     1.46.0  exports["."].default = ./build/index.cjs
     1.47.0  exports["."].default = ./src/index.ts     <- the breakage
     1.48.0  exports["."].default = ./src/index.ts
     1.50.0  exports["."].default = ./build/index.js   <- fixed
     1.51.0  exports["."].default = ./build/index.js

   So the cap is removed and both packages track latest again.

2. npm update, which moves the tree to patched releases already allowed
   by the ranges the parents declare. The lockfile had simply gone stale.

Distinct advisories drop from 34 to 17. Measured across four installs,
each npm ci followed by npm audit:

  main, untouched                     34
  upgrade alone                       33
  upgrade + npm update (this commit)  17
  upgrade + 18 forced overrides        6

An earlier revision of this branch took the last route. It was dropped:
half the reduction needs no overrides at all, and the remaining eleven
advisories can only be bought by forcing majors upstream never tested
together - webpack-dev-server 4->5, uuid 8->11, serialize-javascript
6->7, markdown-it 12->14, linkify-it 3->5, adm-zip 0.5->0.6 - in chains
this project never executes. There is no build step and no dev server,
so webpack, postcss and svgo are installed but never run. Those alerts
will clear as @wordpress/scripts moves, without forced pins to maintain.

Note that npm audit's total rises from 43 to 64 while distinct advisories
halve: it counts packages affected, and the unfixable brace-expansion
advisory cascades widely. Only 5.0.8+ is patched there, and v5 exports
{ expand } instead of the callable default v1/v2 exported, so forcing it
throws "expand is not a function" in minimatch. Verified by running it.

Verified: npm ci exits 0, test:unit-js 9 tests, PHPUnit 1808 tests,
Playwright 72 passed with 1 pre-existing failure - document-types.spec.js
fails identically on main with no changes applied, so it is not a
regression from this upgrade.

Author: erseco

.github/dependabot.yml

@@ -29,17 +29,12 @@ updates:
       prefix: "chore"
       include: "scope"
     open-pull-requests-limit: 5
-    # These two packages must stay below the versions where @wordpress switched
-    # their package "exports" to TypeScript source (./src/index.ts), which the
-    # Playwright runner cannot load under node_modules and breaks the E2E job:
-    #   @wordpress/e2e-test-utils-playwright >= 1.47.0
-    #   @wordpress/scripts >= 32.3.0 (depends on e2e-test-utils >= 1.47.0)
-    # Remove these ignores once upstream ships a compiled (CJS) entry point again.
-    ignore:
-      - dependency-name: "@wordpress/e2e-test-utils-playwright"
-        versions: [">=1.47.0"]
-      - dependency-name: "@wordpress/scripts"
-        versions: [">=32.3.0"]
+    # @wordpress/e2e-test-utils-playwright and @wordpress/scripts used to be
+    # held below 1.47.0 and 32.3.0 here, because those releases pointed their
+    # package "exports" at TypeScript source (./src/index.ts) that the
+    # Playwright runner cannot load. Upstream shipped a compiled entry point
+    # again in 1.50.0 (exports "." -> ./build/index.js), so the cap no longer
+    # applies and both packages track latest again.
 
   # 4. npm (Cloudflare Worker)
   - package-ecosystem: "npm"