build: resolve npm audit advisories

Run npm audit fix, then take the two major upgrades it could not apply
on its own: copy-webpack-plugin 12 -> 14 and webpack-dev-server 4 -> 6.
Between them these clear the shell-quote and websocket-driver criticals
and the serialize-javascript, sockjs and uuid advisories.

Everything changed here is build tooling; none of it ships in the
bundle. webpack-dev-server 6 was verified beyond a successful build by
starting the dev server and confirming the custom devServer.app route
for /manifest.json still answers 200.
Pin watch back to ^0.13.0, the version the other repos already use. Its
1.x line pulls exec-sh and a prototype-pollution advisory in merge, and
npm's own resolution for those advisories is 0.13.0. It only backs the
lint:watch helper script.

Author: antobinary