Fix Dependabot alerts by upgrading rollup, rimraf and svelte

[falkoschindler]

Motivation

Fix Dependabot security alerts for transitive dependency vulnerabilities:

• minimatch (>= 10.0.0, < 10.2.3): resolved by upgrading rimraf to ^6.1.3, which pulls glob@13 → minimatch@10.2.4
• svelte (< 5.53.5): resolved by updating the override in json_editor to >=5.53.5
• rollup upgraded to ^4.59.0 across all elements and examples

Implementation

Bumped rimraf, rollup, and svelte version constraints in all package.json files across nicegui/elements/ and examples/, then regenerated lock files and rebuilt dist bundles.

Progress

• I chose a meaningful title that completes the sentence: "If applied, this PR will..."
• The implementation is complete.
• This is not a security issue.
• Pytests have been added (or are not necessary).
• Documentation has been added (or is not necessary).

Note

I would have pushed directly to main, but we better wait for the CI to confirm that nothing after rebundling so many elements.

[evnchn]

I was not sure so asked Opus to re-build everything and verify. Human notes in bold.

---

Verification: All dist bundles rebuilt against updated dependencies

Ran npm ci && npm run build (or npm install && npm run build where no lockfile exists) for all 12 folders with changed package.json / package-lock.json:

• nicegui/elements/: aggrid, codemirror, echart, joystick, json_editor, leaflet, mermaid, plotly, scene, xterm
• examples/: signature_pad, node_module_integration

Notes:

• For 8 elements (aggrid, echart, joystick, leaflet, mermaid, plotly, scene, xterm), only devDependencies changed (rollup 4.52→4.59, rimraf 6.0→6.1), so dist output is identical to main — as expected (I initially thought all elements must change)
• echart required --legacy-peer-deps due to echarts-gl@2.0.9 requiring peer echarts@^5 while package.json specifies echarts@^6 (pre-existing on main, not introduced by this branch, but can we fix one day?)
• For codemirror and json_editor, dist files differ from main: codemirror due to rollup chunk-hash changes, json_editor due to new overrides (ajv, svelte)
• Working tree is clean after all rebuilds — committed dist files match fresh build output

[evnchn]

echarts-gl for echarts v6 is coming soon: ecomfe/echarts-gl#561