Update packages for dependabot

[cviebrock]

This is an attempt to fix the Dependabot vulnerabilities in the package.

1. Most dependencies have been bumped to the latest versions.
2. The brace-expansion package required by minimatch is still vulnerable, so we override it to the next patch version which fixes the issue.
3. The postcss-url package hasn't been maintained in several years. We only use it in one place in the code to rebase URLs. With the help of AI, I've removed this package dependency and replaced it with a local function to manage the rebasing.

All the CI checks still pass, and pnpm audit returns no vulnerabilities. 🎉

[cviebrock]

Replaced by #23