Replace bootbox with a native dialog for confirmations

[rbruhn]

Replaces bootbox with a small confirmation dialog built on the native <dialog> element and Alpine (which Livewire already loads), and removes the bootbox package. Part of #521 (one less jQuery/Bootstrap dependency).

bootbox has an open cross-site scripting advisory with no fixed version (Dependabot alert #137): it renders its title and message as HTML. BIOSPEX only passed it text from its own views, so the risk was low, but the new dialog removes it by design.

Confirm dialogs

The 10 admin links and buttons marked data-confirm="confirmation" keep their markup (data-title, data-content, data-method, href or data-href).

• <x-confirm-dialog> (resources/views/components/confirm-dialog.blade.php, in the admin layout): a <dialog> whose title and message are set with Alpine's x-text, so they're always text, never HTML. Cancel and Confirm buttons as before.
• resources/js/confirm-dialog.js: one delegated click listener opens the dialog. Confirm navigates for GET, or submits a hidden POST form with _method and the CSRF token, now built with DOM methods instead of concatenating the URL into HTML. Cancel, Escape and a click on the backdrop close it without doing anything.
• Inside Bootstrap modals (the expedition tools modal has confirm buttons): Bootstrap 4 pulls focus back into an open modal, so the dialog is moved into the open modal while it's shown, and back afterwards.
• The bootbox focus-restoring hooks in common.js go; the native dialog returns focus to what opened it.
• Fixes a stray ' at the end of the "Stop Processing" message.

Grid export messages

The subjects grid's "Export Submitted" and "Export Error" alerts (bootboxMsg) become notify() notifications, like the flash messages.

Result

• bootbox removed from package.json, admin-globals.js and the CSS. The admin bundle goes from 94 kB to 77 kB.
• Dependabot alert Find wiki package for site #137 closes once this reaches main.

Tested locally (biospex.test)

On the subjects page, with form submission intercepted so nothing was sent:

• The dialog opens with the button's title and message, and focus moves into it.
• Cancel, Escape and a backdrop click close it without sending anything.
• Confirm builds a POST to /admin/projects/{project}/ocr with _method=post and the CSRF token.
• HTML in data-title/data-content is shown as text (no element created, no script run).
• In the expedition tools modal, the dialog opens inside the modal, keeps focus, and cancelling leaves the tools modal open.

yarn build succeeds; php artisan test --compact: 632 passed.

To verify on development

See #548.

[rbruhn]

Development checks for this PR are on #567.