release: v4.8.9 security hardening patch

- upgrade DOMPurify to patched release (fixes high-severity XSS GHSA-87xg-pxx2-7hvx)
- upgrade esbuild build dependency; npm audit now reports 0 vulnerabilities
- stop tracking config/ice-servers.js (TURN credentials); add example template
- production logger no longer prints error context or info/debug output
- bump version to 4.8.9 across header, manifest, README, init message
- update SECURITY.md supported-release table to v4.8.x

SECURITY.md

@@ -4,7 +4,8 @@
 
 | Release | Status | Protocol |
 | --- | --- | --- |
-| v4.1.x | Supported | 4.1 |
+| v4.8.x | Supported | 4.1 |
+| v4.1.x – v4.7.x | Unsupported | 4.1 |
 | earlier releases | Unsupported | legacy |
 
 Users should run the current supported release line to receive the latest verification, storage, and file-transfer protections.