Upgrade @sentry/webpack-plugin 3.6.1 → 5.4.0

# Upgrade @sentry/webpack-plugin 3.6.1 → 5.4.0 (major)

Dependabot PR #7810. Dev dependency (`devDependencies`, range `^3.6.1`, lockfile resolved 3.6.1); used in `config/webpack.config.js`, gated on `SENTRY_AUTH_TOKEN` so it only runs when that env is set. Pulled out of the weekly Dependabot slot per the major-version process — needs an owner and verification, not a batch merge.

## Compatibility pre-check

- ✅ Node: plugin engines `>= 18`; dev-only, dev/CI Node 24 satisfies it.
- ✅ webpack: peer `webpack >=5.0.0`; installed `^5.88.2`.

## Breaking changes to review

- 4.x: `deleteFilesAfterUpload` renamed to `filesToDeleteAfterUpload`.
- 4.x: `getBuildInformation`, `cleanArtifacts` (non-functional), `bundleSizeOptimizations.excludePerformanceMonitoring` (→ `excludeTracing`), and `_experiments.moduleMetadata` (→ stable `moduleMetadata`) removed.
- 4.x: injected code now block-scoped and uses `let` (min ES2015).
- 5.x: drops Node < 18 and webpack v4.
- Our block uses only `authToken`, `org`, `project`, `telemetry`, `errorHandler` — none of the renamed/removed options above appear in it; confirm from changelog.

## To do before merge

- [ ] Verify a production build with SENTRY_AUTH_TOKEN set still uploads source maps (this plugin only runs then).
- [ ] Reconcile changed plugin options with our config block.
- [ ] Read the 4.x + 5.x changelogs.

## Refs

- Branch: `dependabot/npm_and_yarn/sentry/webpack-plugin-5.4.0`
- PR: #7810
- Upstream: https://github.com/getsentry/sentry-javascript-bundler-plugins/releases

Start with config/webpack.config.js and the 4.x and 5.x changelogs for @sentry/webpack-plugin, checking the listed options against the existing configuration. Run a production build with SENTRY_AUTH_TOKEN set and confirm that source maps upload successfully; done means the configuration is compatible and the verification passes.

Written by the indexing model from the issue text.