…tput with Rollup instead of Browserify

TODO: Some shims for Node.js were disabled to get this initially building for the browser.

* develop:
  (actions) also run on PR. (RobotWebTools#479)
  Fix security issues (RobotWebTools#478)

…e-lock.json is not useful for libraries (it does not get published with libraries), and having it reduces chances of us catching (during development or on CI) breaks in our library due to accidental in-range breaking changes in dependencies

* develop:
  Bump mocha from 9.1.1 to 9.1.2 (RobotWebTools#480)

This allows people to install the package from a git repo (f.e. `npm install roslib@github-username/roslibjs`). by performing the `build` process in the `prepare` script. `prepare` is not only is executed before the `publish` script during publish (so that case is still satisfied), but `prepare` is also executed by `npm` during the `install` process. During `npm install` `devDependencies` are installed in a temporary folder, so those dependencies are even available to the `prepare` script.

The end result is that someone can fork the repo, and easily install it, without having to publish the package under a new name, and without having to build and commit build artifacts into the repo (this is why the build artifacts were recently added to `.gitignore` in this repo a few commits back).

People who rely on global variable script tags can still use URLs like `https://unpkg.com/browse/roslib@1.1.0/build/roslib.js` in their script tags src attributes, or just download such files to the app locally.

(see reasoning in RobotWebTools/ros3djs@f56c58a)