Release the security-audit dependency PRs (#2881–#2888)

## Release the security-audit dependency PRs

Eight approved (lgtm) security-audit PRs are merged/ready but inert — they land code only. They do nothing for users until each extension is version-bumped and published. None of them touch `extension.yaml` or `CHANGELOG.md`.

### Per-extension release steps (each)
- [ ] Bump `version:` in `extension.yaml`
- [ ] Add `CHANGELOG.md` entry
- [ ] Publish to the Extensions registry

### PRs to release
- [ ] #2881 delete-user-data — drop `node-fetch` → global `fetch`
- [ ] #2882 firestore-send-email — bump `nodemailer` ^9.0.1
- [ ] #2883 firestore-counter — drop `deep-equal` → `util.isDeepStrictEqual`, `uuid` → `crypto.randomUUID()`
- [ ] #2884 firestore-shorten-urls-bitly
- [ ] #2885 rtdb-limit-child-nodes (also switches `firebase-functions` → `firebase-functions/v1`)
- [ ] #2886 firestore-translate-text
- [ ] #2887 storage-resize-images — drop `mkdirp`/`uuid`/`uuidv4` → Node builtins
- [ ] #2888 firestore-bigquery-export — drop `node-fetch` → global `fetch`

Common to all: `npm audit fix` dependency bumps + remove unmaintained `rimraf` (clean script now uses native `fs.rmSync`).

### Remaining (unfixed) transitive CVEs — do NOT claim full clearance in release notes
- `uuid@<11.1.1` — pinned under `firebase-admin > @google-cloud/firestore > google-gax` (and `@google-cloud/bigquery`). Needs upstream bump.
- `ts-deepmerge@<8.0.0` — devDep under `firebase-functions-test`. Test-only, breaking upstream.

### Verification done at review
- All 8 reviewed; runtime is `nodejs22` across the board (global `fetch` + `crypto.randomUUID()` both stable).
- #2883 test-validated: CI suite green; `deep-equal` → `isDeepStrictEqual` shown to have no behavioral divergence vs base.