Update TypeScript dependencies for cirq-web

[mhucka]

GitHub's dependency graph for Cirq lists 3 TS dependencies that are out of date:

These don't have PRs from Dependabot for some reason, so these are not really obvious. We should update them at some point.

This is not urgent because cirq-web is not known to be used on any public web pages.

[codrut3]

I downloaded the SBOM and found the following dependency paths:

• npm-live-server-1.2.2 -> npm-chokidar-2.1.8 -> npm-braces-2.3.2
• npm-live-server-1.2.2 -> npm-chokidar-2.1.8 -> npm-readdirp-2.2.1 -> npm-micromatch-3.1.10
• npm-live-server-1.2.2 -> npm-chokidar-2.1.8 -> npm-anymatch-2.0.0 -> npm-micromatch-3.1.10

So the outdated dependencies on braces and micromatch are due to live-server. The ws outdated dependency is no longer present.

Someone attempted to update the live-server dependencies in this pull request but the pull wasn't merged. The pull request author recommended to switch to https://www.npmjs.com/package/five-server in the comments.

Is switching to five-server acceptable for Cirq? If yes, I can look into this.

[mhucka]

Discussed in Cirq Cynq 2025-05-28: if five-server is a straight replacement for npm-live-server, this would be good to do. This is especially the case if npm-live-server hasn't been updated in many years.