chore: bump dependencies

[legobeat]

A range of compatibility, security, stability, and performance fixes.

This should be non-breaking.

See individual commits for details.

[legobeat]

A future PR may look at dropping deps secp256k1(@noble/secp256k1) and bignumber.js entirely. This aims to be a conservative and safe maintenance changeset.

[alex-miller-0]

@legobeat thanks for this!

Note that we do need to keep bignumber.js to keep the same BN encoding as cbor (see this). We do plan to eventually move EIP712 messages to the general signing framework (thus removing the need for the pattern which uses cbor), but that requires quite a bit of firmware work.