Update vulnerable development dependencies and require Node 20

[0xBreadguy]

Problem and result

The existing dependency-check job fails on development dependencies already present on main, including the audit failure observed in #54. Update the dependency lockfile and the pinned brace-expansion override to clear the audit without a major Jest upgrade or changes to token data/generation logic.

Changes

• Raise the existing brace-expansion override from 5.0.6 to 5.0.12. The old exact pin prevented normal audit remediation.
• Refresh compatible transitive dependencies, including Babel 7, browserslist, baseline-browser-mapping, js-yaml 3.15.2, and related browser data packages.
• Use npm ci in generation and formatting workflows, matching the existing audit workflow. All CI installs now consume the reviewed lockfile without rewriting it; an inconsistent manifest/lockfile fails instead of resolving new versions.
• Raise the declared/documented Node minimum from 18 to 20 because the patched brace-expansion releases require Node 20 or newer. CI already runs Node 20. Local contributors using Node 18 need to upgrade.

This is a separate maintainer-level dependency PR based on main at 87fe2b0. It does not depend on #54 and can be merged first; #54 will then need to pick up the updated base and rerun its checks. The diff contains dependency settings, the lockfile, the README prerequisite, and the two CI install commands. The minimum stays at Node 20; no runtime upgrade to Node 24 is included.

Validation

• Clean npm ci --ignore-scripts: successful.
• npm audit --audit-level=low: zero reported vulnerabilities.
• Node 20.20.2: all 16 tests on main pass, TypeScript passes, and repository formatting passes.
• Generation on main produces identical token-list content aside from the existing timestamp update; generated files restored afterward.
• Combined compatibility check with Fix canonical bridge classification and content-based token list versions #54 at 551978a, using these updated dependencies on Node 20: all 39 tests and TypeScript pass. Generation produces only the expected Ethereum ETH bridge correction, mainnet 1.0.1, unchanged testnet, and byte-identical files on a second generation.
• git diff --check: passed.

Audit totals can include packages affected transitively and vary with advisory metadata; the acceptance criterion here is a clean audit on the repaired dependency tree.

[0xBreadguy]

More cleanup.

Features:

• Bump and pin brace to the latest version without noted exploits
• Update the lockfile w/ the latest non-vuln versions
• Bump to node 20 (requirement from the lockfile update)
• Move to npm ci for generation and formatting so that it uses our lockfile

Worked with Astra.