build(deps): combine eight Dependabot updates

[AnuragVasanwala]

What this PR does

Applies eight Dependabot updates in one change, so they land together without lockfile conflicts. Each version and commit is exactly what the Dependabot PR proposed.

PR	Update
#15	@wordpress/env 11.7.0 to 11.16.0
#17	dotenv 17.4.2 to 18.0.4
#18	axios 1.18.1 to 1.20.0 (transitive, lockfile only)
#9	@wordpress/blocks 15.25.0 to 16.1.0
#14	@wordpress/block-editor 16.1.0 to 18.0.0
#13	@rtcamp/eslint-config c5f84e6 to b37138f
#5	@rtcamp/wp-tooling 18d003c to 119e078
#3	actions/deploy-pages v4 to v5.0.1

#9 and #14 go in together on purpose: on its own, either one installs two copies of @wordpress/blocks.

Dependabot closes each PR above once this merges, because the new versions are then on main.

Not included

• build(deps-dev): bump @babel/core from 7.29.7 to 8.0.6 #12 @babel/core 8: the WordPress toolchain is still on Babel 7, so Jest, the build and lint fail.
• build(deps-dev): bump wp-cli/i18n-command from 2.7.0 to 3.0.1 #6 wp-cli/i18n-command 3: it needs an unreleased WP-CLI 3.
• build(deps): bump basic-ftp and @wordpress/scripts #19 @wordpress/scripts 36: test-unit-js now runs Vitest, which needs a separate change.

How I verified

Node 22.19, on top of main at 6fc0712:

• npm ci leaves the lockfile unchanged, and npm install --package-lock-only reports it up to date.
• lint:js, lint:css and lint:package-json pass. Jest passes 19 of 19.
• build:prod passes, and assets/build is byte-identical to main.
• PHPCS and PHPStan pass.
• PHPUnit with wp-env 11.16.0: 117 tests pass on PHP 8.2 with WordPress 6.7, PHP 8.3 with WordPress 6.9, and PHP 8.4 with WordPress 7.1.
• start:assets and start:blocks read their ports from .env.local with dotenv 18.
• wp-tooling validate passes for all 46 scaffolds, and a generated post type uses rtCamp\WPPrimitives\.
• actionlint passes on all workflows.

deploy-pages v5 stays untested here until GitHub Pages is enabled for this repository.