chore: Remove runtime dependency to `@node-red/util`

[Steve-Mcl]

Description

@node-red/util is imported into FlowFuse runtime dependencies solely for the helper functions getObjectProperty and settObjectProperty in forge/containers/stub/index.js (ref)

@node-red/util brings several dependencies itself, one of them being jsonata which is being flagged by trivy as a high vuln.

We could ignore this but in the interest of sanitisation, we could simply create our own getObjectProperty/settObjectProperty functions

@hardillb @ppawlowski
Not knowing how trivy deals with alerts and if they can/should be silenced is this the right course of action?

Epic/Story

No response

Have you provided an initial effort estimate for this issue?

I have provided an initial effort estimate

[hardillb]

If that is the only use, then just lift/shift the required function into the stub file and drop the dependency.

[ppawlowski]

According to Dependabot, the jsonata dependency is introduced by two separate dependencies: https://github.com/FlowFuse/flowfuse/security/dependabot/328
https://github.com/FlowFuse/flowfuse/security/code-scanning?query=is%3Aopen+branch%3Amain+jsonata

[Steve-Mcl]

According to Dependabot, the jsonata dependency is introduced by two separate dependencies: jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion https://github.com/FlowFuse/flowfuse/security/code-scanning?query=is%3Aopen+branch%3Amain+jsonata

Yes it is, and I have raised issue against Node-RED
and will be raising against launcher too (to pick up new version once published)