Fix ejs and cipher-base CVEs; remove unused browserify/babelify (#759)

* Fix ejs and cipher-base CVEs via npm overrides instead of fake direct deps

Bot PRs #755 and #754 each added ejs/cipher-base as new direct
dependencies to force a version bump, but #755's approach didn't even
work: it only bumped the hoisted top-level ejs copy, leaving the
actually-flagged nested copy at @codedungeon/utils/node_modules/ejs
stuck on 2.6.1. Neither package is required anywhere in our own code;
both are transitive deps of dev tooling (ejs via @codedungeon/gunner's
CLI helpers, cipher-base via browserify's crypto-browserify polyfill
chain) - not the vendored EJS engine np.Templating actually uses.

Using "overrides" forces every copy in the tree to the patched
version without adding unused top-level dependencies.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Remove unused browserify/babelify, dropping cipher-base entirely

browserify was leftover from a 2023 React-webview experiment
(dwertheimer.React) and is no longer invoked anywhere - the project
now bundles via scripts/rollup.js. babelify is a browserify-only
Babel transform, so it's dead weight without browserify too.

Removing them drops the crypto-browserify -> create-hash/create-hmac
-> cipher-base chain from the tree entirely, so the cipher-base
override from #754 is no longer needed - the package isn't installed
at all now, not just pinned to a patched version.

Verified: np.Templating test suite (65 suites, 1270 tests), npc CLI,
and scripts/rollup.js all still work with these removed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: dwertheimer