fix(deps): update terser-webpack-plugin to drop serialize-javascript

[platex-rehor-bot]

Description

Update terser-webpack-plugin from 5.3.14 to 5.6.1, which dropped serialize-javascript as a dependency entirely. This resolves CVE-2026-34043 — a Denial of Service vulnerability caused by CPU exhaustion when serializing specially crafted array-like objects in serialize-javascript < 7.0.5.

RHCLOUD-46792

---

Anything reviewers should know?

• terser-webpack-plugin 5.6.1 is still within the ^5.3.11 semver range required by webpack 5.103.0
• serialize-javascript was removed as a dependency in terser-webpack-plugin 5.4.0+ (they internalized the serialization logic)
• Only package-lock.json changed — no package.json modifications needed
• Lint and build pass cleanly

---

Checklist

• Accessibility: color contrast, keyboard nav, screen reader tested (or N/A)
• All PR checks pass locally (build, lint, test)
• No unrelated changes included

AI disclosure

Assisted by: Claude Code

[platex-rehor-bot]

Squashed previous commits into a single atomic commit and added a Dockerfile cleanup to resolve the pre-existing Grype scan failures.

Changes:

• Removed serialize-javascript from the dependency tree (original CVE fix)
• Upgraded @babel/* to 7.29.7
• Removed unused npm install yarn and deprecated npm i --only=dev from Dockerfile
• Added rm -rf of all node_modules directories after npm run build — the final image only serves static files via nginx, so Node.js packages are dead weight and a source of false-positive CVE findings

This should resolve the Grype scan failures that were pre-existing across all branches, since the scan was finding vulnerable transitive packages in the globally installed npm and the app's node_modules — none of which are needed at runtime.

[jjaquish]

LGTM