Update package.json to newer, secure versions

[mehigh]

https://github.com/xwp/site-performance-tracker/security/dependabot

[loganwisniewski]

@mehigh Here are my initial findings:

Regular expression denial of service (https://github.com/xwp/site-performance-tracker/security/dependabot/3):

• eslint@8.10.0 already has an isolated dependency of glob-parent@6.0.2 (not sure why this would be a conflict)
• copy-webpack-plugin@10.2.4 already has an isolated dependency of glob-parent@6.0.2 (not sure why this would be a conflict)
• gulp@4.0.2 is already installed as the latest available version

Uncontrolled Resource Consumption in markdown-it (https://github.com/xwp/site-performance-tracker/security/dependabot/1):

• @wordpress/scripts@22.1.0 updated to @wordpress/scripts@22.2.1 (latest) locally still contains the outdated markdown-it@12.0.4

Would should be my approach? I've seen ways to force dependency versions but that doesn't seem like a very stable way to handle these vulnerabilities.

[mehigh]

@loganwisniewski please contribute a PR which updates all of the dependencies to the latest versions.
If there are libraries still relying on a vulnerable version we can create a ticket in their repositories and contribute a fix there, as it happens with the wordpress/scripts.

We don't need to spend a lot of time on this, but at least do our due diligence in at least passing (or contributing too, as it is not too much of an ask for a npm dependency) the information and improving security in the tools we're using.

[kasparsd]

The result of npm audit fix should be enough. The only dependency we're actually using outside of dev-dependencies is:

site-performance-tracker/package.json

Lines 65 to 67 in 6be53c6

	"dependencies": {
	"web-vitals": "^2.1.4"
	}

so we can ignore any dev-dependency related warnings.

[dilipom13]

Hello
Create a PR: #140 for this issue. Please review it.
Thank You.