This PR modernizes and cleans up development dependencies in the project to get rid of all security alerts and make it more maintainable. There's a lot of changes, but all commits here are self-contained so you can review one by one.

• Remove browserify — it basically stopped being used after first step of ES6 conversion + browserify -> rollup #945 but wasn't removed.
• Remove mapbox-gl depedency — it was used only for the Evented class used for benchmarks, but I wrote a minimal standalone Evented instead to avoid the dependency, and used CDN links for the debug/bench pages instead of serving from node_modules.
• Remove @mapbox/flow-remove-types because it's no longer needed after eliminating mapbox-gl dependency.
• Remove mapbox-gl-js-mock dependency — it's been unmaintained for 5 years and it was originally written for mapbox-gl-draw tests anyway, so I wrote a new mock implementation vendored in this repo.
• Remove express and the custom server.js because after the Rollup change, we can serve everything statically.
• Remove rollup-plugin-node-builtins because it became unnecessary after Remove GeoJSON validation #1052 — we no longer use any Node built-ins in the bundle.
• Upgrade all dependencies to their latest versions, updating configuration where necessary.