chore(deps): bump browserslist to 4.28.9 to fix high severity audit

[aharoitx]

Problem

The audit job fails on every open PR. It is not caused by any of them:
running npm audit --audit-level=high on a clean 8.0.x exits with code 1.

browserslist@4.28.1 has two high severity advisories:

• GHSA-c83g-rgw3-j3cx — unbounded memory growth (no cache eviction), leading to OOM
• GHSA-73wf-gq98-2v4g — uncaught crash / prototype write via browserslist-stats.json

Both are fixed in 4.28.7+.

Fix

npm update browserslist --package-lock-only → 4.28.9.

Only package-lock.json changes (27 insertions, 42 deletions). browserslist is
a transitive dev dependency (via @babel/helper-compilation-targets, core-js-compat
and update-browserslist-db), requested with a ^4.x range — refreshing the lockfile
is enough. No override needed, package.json untouched.

Verification

Before: 3 vulnerabilities (1 low, 1 moderate, 1 high) → exit 1
After: 2 vulnerabilities (1 low, 1 moderate) → exit 0

The two remaining ones do not block at --audit-level=high:

• elliptic (low, prod, no upstream fix available)
• @humanfs/node (moderate, dev) — resolved by chore(deps-dev): bump @humanfs/node from 0.16.7 to 0.16.8 in the npm_and_yarn group across 1 directory #381

Locally: build, format:ci, lint and unit all pass.