avm1: Fix function closures inside `with`

When creating a scope for a closure, any `with` scopes were being
filtered out, but this was incorrect; `with` scopes are still on
the scope chain when the function is called.

chore: Bump to wgpu 0.12

html: Fix handling of end tag mismatch

Flash ignores mismatched end tags (i.e. end tags with a missing/different
corresponding start tag). `quick-xml` checks end tag mismatches by
default, but it cannot recover after encountering one.

Commit 7e20543 already disabled
`quick-xml`'s check, but that caused mismatched `Event::End` to be
handled, which may empty `format_stack` and later panic on
`format_stack.last().unwrap()`.

Thus, check for mismatched end tags ourselves, in a similar manner
of `quick-xml`, but in a recoverable way.

web: Add a comment about `ignorePatterns`

web: Fix `publicPath` when loaded from a CDN

CDNs allow omitting the filename:

* https://unpkg.com/@ruffle-rs/ruffle
* https://cdn.jsdelivr.net/npm/@ruffle-rs/ruffle

That caused `currentScriptURL` to be determined incorrectly:

```js
new URL(".", "https://unpkg.com/@ruffle-rs/ruffle").href
// "https://unpkg.com/@ruffle-rs/"
```

If the filename is omitted, append a slash to prevent the last
component from being dropped:

```js
new URL(".", "https://unpkg.com/@ruffle-rs/ruffle/").href
// "https://unpkg.com/@ruffle-rs/ruffle/"
```

chore: Publish npm package publicly

web: Add custom profiles to separate the build cache for the two wasm…

… modules

extension: Change unsafe-eval to wasm-eval in CSP

`unsafe-eval` was needed in the extension Content Security
Policy to Wasm compilation in Chrome.

This CSP setting causes the extension to get flagged in the
Mozilla Add-On Marketplace, which discourages the use of
`unsafe-eval`.

However, Chrome has a `wasm-eval` CSP setting which also allows
extensions to compile Wasm without requiring `unsafe-eval`.
Inject this into the extension manifest when building the Chrome
extension.

Eventually this may change to `wasm-unsafe-eval` as drafted by
the CSP spec and be required by all browsers.

web: Migrate to npm workspaces

`lerna` is a bit stale, and as such it currently has some outdated
dependencies which Dependabot warns on.
Fortunately, npm 7 supports monorepos natively, via "workspaces". So
simply replace `lerna` with this feature. The migration is pretty
neat and requires a very little invervention.

Because Node.js 14 comes with npm 6 by default, upgrade it manually
as shown in bahmutov/npm-install#103 (comment).

core: Remove `Player::is_mouse_down`

Now that `InputManager` tracks the mouse button, it can be used
instead.