Drop web-ext's adbkit, and node-forge with it (fixes #301)

[Nawid3333]

Fixes #301 (Dependabot alert #60, GHSA-86w9-cpqp-85rv, high).

Is a fix on the way? No.

• node-forge 1.4.0 (March) is the newest release; the advisory has no patched version.
• The report reached the maintainers in June, with no answer. Four fix PRs from outside (#1152, #1157, #1158, #1159) wait unreviewed. The only commits since 1.4.0 are a security-policy update and a test fix (2026-09-22).
• web-ext's own maintainers put this advisory on their ignore list on 2026-10-05 (Ignore node-forge security issue for now mozilla/web-ext#3887); there's no newer web-ext or adbkit release.

The fix: we don't need the package at all

• node-forge arrives only through web-ext → @devicefarmer/adbkit. web-ext loads adbkit only to run an extension on Firefox for Android: extension-runners/index.js imports firefox-android.js, the only importer of util/adb.js, only for that target.
• One override in pnpm-workspace.yaml ('web-ext>@devicefarmer/adbkit': '-') removes adbkit, node-forge and four packages only they used. The lockfile loses them, nothing else.
• The only cost: web-ext run -t firefox-android, which nothing here does.

Checked

• Loaded without adbkit:
  • web-ext's build, lint, sign and run commands, and the desktop runner;
  • web-ext/util/submit-addon (used by tools/fetch-amo-signed.mjs).
  • Only the Android runner fails, as it should.
• Tools: build, build:keep, lint:github, lint:amo (0 errors), lint, typecheck, vitest 2260.
• Unchanged: the lockfile stays one YAML document.
• After the merge: Dependabot should close alert ci: update PRs merge themselves when they ship nothing, and report the rest #60 once main's lockfile no longer has node-forge, and security-alerts.yml then closes Security alert: node-forge #301.

🤖 Generated with Claude Code