task: #3636737 Use @webship-js/drupal-core-steps 2.1 for the webship-js suite and refresh the dependencies

Summary

The Gherkin Script functional tests (webship-js, Cucumber) now run on the public step pack @webship-js/drupal-core-steps (^2.1.0), so login by handle and the testing users are maintained in the pack instead of being copied into this project.

• package.json: adds @webship-js/drupal-core-steps ^2.1.0 as a devDependency, moves webship-js from ^2.0.0 to ^2.0.6 (the version the pack declares as its peer dependency) and adds a test:dry script (cucumber-js --config cucumber.js --dry-run).
• cucumber.js: loads the step glob of the pack between webship-js's own steps and the project's own. The users registry already has the pack's shape (username, email, password, roles, isAdmin), so it is unchanged.
• tests/step-definitions/gherkin.steps.js: removes the two custom steps the pack now provides, the login by handle and I add testing users. They matched the same sentences as the pack's steps, so each of those sentences would match two definitions. The project's own steps stay: the field and button checks, the Ace editor step and the CSS check.
• .gitlab-ci.yml: a dry run (cucumber-js --dry-run) in the webship-js-test job before the browser run, so an undefined or ambiguous step fails early, and DRUPAL_CORE pinned to 11.4.x-dev in the variables and in the composer job (the second commit, see below).

The project already used node:24 in its jobs and tracks no lock file (.gitignore covers yarn.lock), so those do not change here.

Why the core is pinned

The first pipeline of this merge request failed in webship-js-test without the pin. The templates default to the stable core they list (11.4.9 in that run), and the update status of Drupal reported "There is a security update available" as an error message on the administration pages. The testing users step of the pack checks the page messages, which the custom step it replaces did not, so it stopped on that message and the Authenticated user was never created. The second commit pins the Drupal core 11.4 development branch instead. The second pipeline installed 11.4.13-dev, the notice did not come up, and webship-js-test passed: the dry run reports no problem and the browser run passes all 10 scenarios (60 steps).

Issue: https://www.drupal.org/node/3636737

Test notes

Locally with Node 24 and Yarn 4.18.1, installing without a lock file as CI does (with --mode=skip-build, which skips the browser download): webship-js 2.0.6, @webship-js/drupal-core-steps 2.1.0 and @cucumber/cucumber 10.0.1 resolve, and the install leaves no untracked files. The dry run (./node_modules/.bin/cucumber-js --config cucumber.js --dry-run, the command the CI job now runs first) covers 10 scenarios and 60 steps, with no undefined and no ambiguous steps.

AI-Generated: Yes (configuration and step cleanup; reviewed by Rajab Natshah.)

Checkpoints:

• File an issue
• Addition/Change/Update/Fix
• Testing to ensure no regression
• Automated unit testing coverage
• Automated functional testing coverage
• UX/UI designer responsibilities
• Readability
• Accessibility
• Performance
• Security
• Developer Documentation
• User Guide Documentation
• Reviewed by human
• Code review by maintainers
• Full testing and approval
• Credit contributors
• Review with the product owner
• Release notes snippet
• Release