deps: replace outdated bitwise-xor with buffer-xor

[BethGriggs]

The bitwise-xor package has not been updated in 8 years and uses the deprecated new Buffer constructor. Replace it with the buffer-xor package. This package is more widely used in the ecosystem and should be a drop-in replacement.

---

Comparing bitwise-xor to buffer-xor:

• No publish of bitwise-xor for 8 years and still at v0.0.0 on npm.
• bitwise-xor has ~14,000 downloads versus buffer-xor with ~11,500,000 (so more ecosystem scrutiny on buffer-xor).
• bitwise-xor uses the deprecated new Buffer() constructor.

---

I have a few dependency update PRs - but figured it makes sense to open them as separate PRs so we can isolate any potential problems or test failures.