chore(deps): consolidate dependency bumps + fix webpack SSRF in samples/weather-forecast

[Copilot]

Consolidates dependabot PRs #233–#238 into a single update and closes two webpack SSRF security alerts (#96/#97) where a transitive webpack@^5 was resolving to the vulnerable 5.101.3.

Dependency bumps

• Runtime: axios ^1.13.5→^1.15.0, @staffbase/widget-sdk ^3.15.5→^3.17.0, acorn ^8.15.0→^8.16.0, dayjs 1.11.18→1.11.20
• Dev: typescript 5.9.2→6.0.2, @types/node 24.5.2→25.5.2, copy-webpack-plugin ^13.0.1→**^14.0.0**, @babel/core|preset-*, @testing-library/*, core-js, jest-environment-jsdom, prettier, ts-loader, webpack-dev-server
• Transitive (yarn.lock only): follow-redirects 1.15.9→1.16.0

Security: webpack SSRF (CVE-2025-68157 / CVE-2025-68458)

Both CVEs (HTTP-redirect allowedUris bypass and URL userinfo bypass, fixed in webpack ≥5.104.1) were exploitable through a transitive dependency requiring just webpack@^5, which yarn resolved to the unfixed 5.101.3 independently of the project's own ^5.104.1 pin.

Fix: pin via yarn resolutions so all ranges collapse to 5.105.4:

"resolutions": {
  "webpack": "5.105.4"
}

# yarn.lock — before: two separate entries
webpack@^5:          version "5.101.3"  ← vulnerable
webpack@^5.104.1:    version "5.105.4"

# after: single entry
webpack@5.105.4, webpack@^5, webpack@^5.104.1:
  version "5.105.4"

TypeScript 6 compatibility fixes

• tsconfig.json: add "ignoreDeprecations": "6.0" — TS6 now errors on the deprecated moduleResolution: "node" and baseUrl options (TS5101/TS5107)
• webpack.common.ts: replace require("copy-webpack-plugin") with an ES import — TS6 no longer implicitly provides the require global (TS2591)
• dev/widget-api-mock/index.ts: add flags: [] to the BranchInformation mock — new required field introduced in @staffbase/widget-sdk 3.17