chore(ci): TEMPORARY - install the unreleased webpack-dev-middleware

DO NOT MERGE THIS COMMIT. Revert it, and set the dependency back to a
released `^8.4.0`, once webpack-dev-middleware ships the changes below.

This branch needs APIs the published 8.3.0 does not have (`onConnect` with the
request, `handleUpgrade`, `publish`, `publishTo`, `hot.client.path` as parts,
`hot.client.logging` with a name, an `error` action). CI installs from the
registry, so `tsc` failed in the Build step and every job behind it was
cancelled — which says nothing about whether the code works.

This vendors a pack of the middleware as it will be once these land:

  - webpack/webpack-dev-middleware#2459  (client path in parts)
  - webpack/webpack-dev-middleware#2462  (logger name)
  - webpack/webpack-dev-middleware#2463  (says when the connection goes away)

on top of `main`, which already carries #2458, #2460 and #2461. The lockfile
change is confined to that one dependency and its own metadata.

To undo, with the release out:

    git revert <this commit>
    npm install webpack-dev-middleware@^8.4.0

Squash-merging also drops it, but only if the branch's last state is clean.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA

Author: alexander-akait

package-lock.json

@@ -87,7 +87,7 @@
     "selfsigned": "^5.5.0",
     "serve-index": "^1.9.2",
     "tinyglobby": "^0.2.15",
-    "webpack-dev-middleware": "^8.0.3",
+    "webpack-dev-middleware": "file:vendor/webpack-dev-middleware.tgz",
     "ws": "^8.20.0"
   },
   "devDependencies": {