chore: update dependencies and clean up dev tooling

- update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel
  supports 8, eslint on 9.x for neostandard, typescript on 6.x for
  typescript-eslint)
- remove unused coveralls package (CI uses the Coveralls GitHub Action)
- replace sinon with nise + vitest.spyOn in the v1 compatibility tests
- regenerate package-lock.json: npm audit now reports 0 vulnerabilities,
  which should close the open dependabot alerts on the lockfile
- rebuild dist