Fix almost all dependabot alerts

[anton-trunov]

Fixes #140.

This alert is not fixed: https://github.com/tact-lang/tact/security/dependabot/13.

NPM says the vm2 package has been deprecated and the maintenance of the project has been discontinued and suggests migrating the code to the isolated-vm package.

It seems we only depend on vm2 indirectly via release-it, so it's not of concern to us.