client-admin module upgrade

[thomassth]

cleaned out most packages that had vulnerabilities.

Remaining 1 vuln from npm audit --prod is related to React Router v6, which is a more substantial upgrade; will do in a separate commit.

[ballPointPenguin]

Using ~ instead of ^ for versions in package.json was an intentional choice to avoid breaking changes from JS package churn. To maintain stability, it's better to manually update package.json after testing new versions, than to allow npm to ^^^ bump versions unexpectedly.

[ballPointPenguin]

For example @thomassth here's a much more cautious set of updates; #1824
(But maybe this doesn't solve the vulnerabilities?)