Address `Platforms/emscripten/browser_test/package-lock.json` Dependabot alerts

[ezio-melotti]

Dependabot is currently reporting a few vulnerabilities in Platforms/emscripten/browser_test/package-lock.json.
These alerts are separate from the regular updates listed in dependabot.yml.

There are 5 solutions to this problem:

1. manually update those deps and fix the alerts;
2. manually ask dependabot to create security updates for each alert (like ¹);
3. manually dismiss the alert;
4. configure Dependabot to check and create PRs to update the deps in package-lock.json;
5. configure Dependabot to ignore package-lock.json (if possible);

If we decide to go with 1/2/3, we would need to manually intervene for any future alert, so 4/5 are better solutions in the long term. If we go with 4/5 it should be enough to list the main branch in dependabot.yml to solve the alerts since Dependabot only looks at the main branch, unless we want to update deps on maintenance branches and/or keep all branches aligned.

@hoodmane, do you have any preference?

Footnotes

1. https://github.com/python/cpython/pull/158394 ↩

[freakboy3742]

FWIW, my preference would be 4/5 - automated processes for this sort of thing are always preferable. If there's an option to have that automatically for maintenance branches as well, then all the better; but I'm not sure if that breaks any other tooling around tracking back ports.

[hoodmane]

I agree that not having to manually update the dependencies would be great and backporting them is also preferable.