Update Electron resources dependencies and clear all npm advisories

[gwleuverink]

Updates every dependency in resources/electron so native:run stops surfacing npm security advisories. npm audit goes from 26 vulnerabilities (1 critical, 16 high, 8 moderate, 1 low) to 0. Composer was checked too and needs nothing.

Versions were researched and pinned deliberately rather than blind-bumped: latest minor/patch within each current major, crossing a major only where an advisory forces it. That happens in two places, Electron and Vitest, both covered below.

Vitest 4 migration

The critical vitest advisory only clears on 4.x, and v4 had two breaking changes for us:

• It no longer auto-installs the coverage provider, so @vitest/coverage-v8 is now an explicit devDependency and --coverage.all (removed in v4) becomes --coverage.
• It constructs mock implementations with new, so arrow-function factories throw "is not a constructor". The electron-store mock is now a class and the Notification, BrowserWindow, and Tray mocks are regular functions.

Plugin tests are green: 18/18 pass.

Why Electron is capped at 40 for now

40.10.2 is the smallest bump that clears the advisory (fixed in 39.8.5) and stays on a supported major. Going further means taking on the 41 and 42 API changes below for no extra security. OS support floors are unchanged from 38 (macOS 12+, Windows 10+).

What's needed to go to 42 and beyond

• macOS notifications. Electron 42 swaps the deprecated NSUserNotification for UNNotification, which only renders notifications when the app is code-signed. We construct Notification directly in the main process, so unsigned dev and local builds would silently stop showing notifications. Needs a signing story documented for app developers first.
• Binary install flow. From Electron 42 the npm package downloads the binary on first run of the bin script instead of in postinstall. Worth confirming our build and run flow handles that cleanly.
• ASAR integrity. Stable since 39, with a macOS digest in 41. Validation hard-terminates on any mismatch, so if we enable it we'd want to check it against how we bundle the PHP runtime.

[SRWieZ]

Thanks for this bump and also for the explanations

[PeteBishwhip]

LGTM. Ty!