Fix serialize-javascript security alerts

[WiXSL]

Summary

• override the transitive @rollup/plugin-terser resolution from 0.4.4 to 1.0.0 in yarn.lock
• update serialize-javascript from 6.0.2 to 7.0.5
• keep the change limited to the ra-offline build chain

Alerts

• https://github.com/marmelab/react-admin/security/dependabot/266
• https://github.com/marmelab/react-admin/security/dependabot/294

Why

workbox-build@7.4.0 depends on @rollup/plugin-terser ^0.4.3, which resolves to 0.4.4 and pulls in vulnerable serialize-javascript@6.0.2. There is no patched version reachable within the 0.4.x line, so this forces the resolution to @rollup/plugin-terser@1.0.0, which depends on serialize-javascript@^7.0.3.

Validation

• yarn why @rollup/plugin-terser
• yarn why serialize-javascript
• yarn install --immutable --mode=skip-build
• Diff is limited to yarn.lock

[WiXSL]

No safe fix is reachable in the current dependency chain. Forcing the upgrade breaks CI, so I am dismissing this until an upstream fix is available.