Node bump

[duncdrum]

close #222

bumps node to 18, lots of vulnerability fixes, more could be done, but I think this is fit for a maintenance release. Could be a major release, as we are deprecating older versions of node during build time.

P.S.: once this is merged we should check #215

[duncdrum]

@line-o mind taking a look and merging?

[line-o]

The version has to be 4.0.0-snapshot as the processor version must be 6.1.0 because of slf4japi version is now v2

[line-o]

See my open PR

[duncdrum]

@line-o ok I see, however, the changes to slf4japi are unrelated to the changes in this PR. The version bump should have been made with those earlier PRs.

If we bump the processor dependency now, without a published jar file, we can no longer compile monex, or create releases from the main branch. Which leaves us two options:

• merge to main, but without a release
• create a special release branch, reverting the slf4japi changes to cut a security release from.
• reverting the changes on main would break ongoing tests of develop so that's not really an option.

I don't really care which way, having a security release would probably be nicest for users.

I have no idea where I can find the exist.java-api.version not sure if we're in lockstep or if it needs to change from 5.4.0