Upgrade to resolve-url-loader v5

[stof]

This is a slight BC break in case someone configures the resolveUrlLoaderOptions when enabling the sass-loader.

BC breaks in that loader between v3 and v5:

• node 12 is required (fine as Encore already requires it) not actually fine.
• the engine option is gone, keeping only the postcss-based engine. The rework engine was not recommended anymore in v3, officially deprecated in v4 and removed in v5. given that the rework library is essentially unmaintained and has lots of bugs with modern CSS, I strongly doubt that any webpack-encore users would have made the choice to use that old engine instead of the default one
• the join option changed the signature of the function. This is a very advanced customization option

This will avoid many warnings when installing dependencies:

• rework depends on several unmaintained packages that have been deprecated in the npm registry
• The postcss version used by this loader has been updated to postcss 8, which avoids the warning about postcss 7 being vulnerable to ReDoS.

[stof]

Actually, I was wrong. Encore still supports node 10.

@weaverryan I strongly suggest doing a new major version of Encore bumping the min version to node 12 (or even node 14 as node 12 is EOL in April) instead of keeping support for the EOL node 10. More and more npm packages are bumping their min version.

[stof]

btw, our CI uses yarn install --ignore-engines on node 10, which is a sign that we already do a mess there (which might hide warnings that projects using encore would see on node 10)

[weaverryan]

I was thinking about dropping 10 and doing a major release also. I have another PR - #1033 - open that upgrades EVERYTHING that’s out of date, with the idea of making the most out of our major release.

[weaverryan]

btw, our CI uses yarn install --ignore-engines on node 10, which is a sign that we already do a mess there (which might hide warnings that projects using encore would see on node 10)

To match up with Ubuntu's LTS version, and its Node version, I was trying to hold onto Node 10 support as long as possible. But because of what you mentioned, it was already shaky.

[stof]

@weaverryan I opened #1079 to discuss that.

[weaverryan]

Closed in favor of #1033, which is ready now