Update development dependencies

[martincizek]

Clears all 41 open Dependabot advisories. Every one of them was in the
development dependency tree — the library itself has no runtime dependencies.
npm audit now reports 0 vulnerabilities.

Supersedes the currently open Dependabot PRs (#15, #16, #20, #21, #22, #23).

What had to change

Most advisories could not be fixed by bumping a version, because they came in
through tools that are unmaintained or that were pinning old transitive deps.

Change	Why
Rollup 2 → 4, rollup-plugin-babel → @rollup/plugin-babel, rollup-plugin-node-resolve → @rollup/plugin-node-resolve	Rollup < 2.80 advisories; both old plugins are deprecated. Config moved to rollup.config.mjs, since it now has to read package.json explicitly.
ESLint 7 → 9, flat config in eslint.config.mjs	ESLint 7 pulled in vulnerable ansi-regex, flatted, lodash, minimatch.
eslint-plugin-jsdoc 30 → 62	Needed for ESLint 9.
dtslint → plain tsc -p types	dtslint is deprecated, was by far the largest source of advisories (request, tar, form-data, tough-cookie, json-schema, tmp, uuid, qs, …) and no longer runs at all on current Node — it fails with Cannot find module .../typescript-installs/4.1/node_modules/typescript.
jsdoc 3 → 4	Drops taffydb (critical), refreshes markdown-it / linkify-it / underscore.
jasmine 3 → 5, Babel 7.11 → 7.29	Advisories in @babel/traverse, @babel/helpers, fast-glob / micromatch / braces.
Dropped @babel/plugin-transform-runtime	Unused — nothing referenced it.
CI: actions/checkout@v5, actions/setup-node@v5, Node 22 + 24 matrix, npm ci	Old pinned actions; the new toolchain needs a current Node.

No library behaviour is changed by this PR. The only edits under src/ are a
redundant eslint-disable comment and one JSDoc type spelled Object<> instead
of object<>; neither reaches the build output.

Things worth a second look

IE 11 was about to be dropped silently. The Babel target was
> 1%, IE 11, not op_mini all, not dead. Current browserslist data classifies
IE 11 as dead, and not dead is applied after IE 11, so it removed it
again — the rebuilt bundles came out as ES2015+ (class, const, arrow
functions, spread). I reordered the query to
> 1%, not op_mini all, not dead, IE 11 so that the published output stays
ES5, since this PR should not change what ships. If you would rather drop
IE 11, that is now a one-line change — but it is a deliberate compatibility
decision, not a dependency bump.

eslint-config-airbnb-base is unmaintained (last release 2022, eslintrc
only). It is loaded through FlatCompat, minus valid-jsdoc and
require-jsdoc which no longer exist in ESLint core. package.json
overrides relaxes its stale eslint peer range, and tsd-jsdoc's stale
jsdoc peer range. Both work, but replacing them is the obvious follow-up.

Two rules needed pinning to keep the existing code and doc style:
function-paren-newline (airbnb-base v15 changed it to multiline-arguments)
and jsdoc/tag-lines (successor of jsdoc/newline-after-description).
jsdoc/check-examples had to be dropped — it does not work on ESLint 8+.

Known failing job: Node 24

One spec fails on Node >= 23, and it fails on master too — it is not caused by
anything in this PR. UnionReplacer.js should fail for '/(?<foo>foo)/,…'
expects a SyntaxError for the same capture group name used in two rules;
ES2025 duplicate named capturing groups made that pattern legal and V8 has
shipped it.

This PR does not touch that spec. Adding an explicit Node matrix is what makes
the failure visible — previously actions/setup-node@v1 ran on whatever Node
the runner happened to ship. Handling it is its own topic and lives on
feature/duplicate-named-capture-groups.

Say the word if you would rather pin this PR's matrix to Node 22 so it goes
green, and add 24 once that branch lands.

Verification

• npm ci from a clean tree → prepare → build + lint + test.
• eslint . and tsc -p types: 0 errors, 0 warnings.
• npm audit: 0 vulnerabilities.
• 33 of 34 specs pass; the one failure is the pre-existing Node >= 23 issue above.

Build output comparison

types/index.d.ts regenerates byte-identical.

The three bundles differ only in:

1. Babel's own _construct / _isNativeReflectConstruct helper
   implementations (upstream Babel rewrote them; still ES5),
2. Rollup's UMD wrapper paren placement, }(this, ...) becoming })(this, ...),
3. export default UnionReplacer; becoming export { UnionReplacer as default };
   in the ESM build.

The library code itself is unchanged line for line, and all three bundles still
parse as ES5 (verified with acorn, ecmaVersion: 5).

Beyond the textual diff, the old and new bundles were compared behaviourally:
6446 differential assertions over CJS + UMD (5 flag sets × 520 inputs,
extended replacements exercising the full MatchingContext API, a custom
ReplacementBuilder, the combined regexp source, and constructor error
messages), plus a smaller check for the ESM build. All identical.

Type tests

types/test.ts kept every assertion; only the notation changed, as dtslint's
comment directives are gone:

• // $ExpectError → // @ts-expect-error (TypeScript reports an unused
  @ts-expect-error, so each one is still a real assertion)
• // $ExpectType T → expectType<T>()(value), a small exact-type helper

Both directions were verified to fail when deliberately broken.

[pavelhoral]

LGTM