fix(deps): bump html-to-text to 10.0.1 to resolve deepmerge-ts CVE

html-to-text 10.0.1 is a dependency-only security release that bumps
its deepmerge-ts dependency from ^7.1.5 to ^8.0.1, fixing a stack
exhaustion vulnerability (GHSA-ggr8-5vv4-36mx) when merging recursive
object graphs. No other code changes between 10.0.0 and 10.0.1.

Full test suite passes unchanged (253/253 assertions) before and
after the bump.

Fixes #432

Author: defeldman

package-lock.json

@@ -20,7 +20,7 @@
     "dependencies": {
         "encoding-japanese": "2.2.0",
         "he": "1.2.0",
-        "html-to-text": "10.0.0",
+        "html-to-text": "10.0.1",
         "iconv-lite": "0.7.3",
         "libmime": "5.4.2",
         "linkify-it": "5.0.2",