Support for vm2 package discontinued with critical security advisories

Adding to what's above, this is the dependency tree:

yarn why vm2
yarn why v1.22.19
[1/4] 🤔  Why do we have the module "vm2"...?
[2/4] 🚚  Initialising dependency graph...
[3/4] 🔍  Finding dependency...
[4/4] 🚡  Calculating file sizes...
=> Found "vm2@3.9.12"
info Reasons this module exists
   - "nightwatch#proxy-agent#pac-proxy-agent#pac-resolver#degenerator" depends on it
   - Hoisted from "nightwatch#proxy-agent#pac-proxy-agent#pac-resolver#degenerator#vm2"
info Disk size without dependencies: "780KB"
info Disk size with unique dependencies: "1.3MB"
info Disk size with transitive dependencies: "1.3MB"
info Number of shared dependencies: 2
✨  Done in 0.17s.

It looks like upstream is working on it: https://github.com/TooTallNate/proxy-agents/issues/218

This is fixed in proxy-agents as of 6.3.0, but we're only using proxy-agents because it's a dependency of nightwatch 1.6.x. In Drupal 10 and above we're using nightwatch 2.3.x which doesn't have this dependency. I suspect there won't be a new 1.6.x release of nightwatch so we might be stuck with this for Drupal 9.

Opened issue to Nightwatch https://github.com/nightwatchjs/nightwatch/issues/3820 and we will see.