Bump ICU MessageFormat

[askvortsov1]

Fixes #3072

Changes proposed in this pull request:
This uses Intl.PluralRules for plural rules, and fixes a security vulnerability allowing JS injection through translation arguments.

Vuln fix in underlying repo works by escaping HTML symbols in all user provided arguments that are strings or nested arrays of strings (since those could get flattened in).

Reviewers should focus on:
Tests for the vuln fix:

• https://github.com/askvortsov1/rich-icu-message-formatter/blob/main/source/RichMessageFormatter.test.js
• https://github.com/askvortsov1/rich-icu-message-formatter/blob/main/source/utilities.test.js#L197

Anything I missed / that should be added?

Necessity

• Has the problem that is being solved here been clearly explained?
• If applicable, have various options for solving this problem been considered?
• For core PRs, does this need to be in core, or could it be in an extension?
• Are we willing to maintain this for years / potentially forever?

Confirmed

• Frontend changes: tested on a local Flarum installation.
• Backend changes: tests are green (run composer test).
• Core developer confirmed locally this works as intended.
• Tests have been added, or are not appropriate here.

[SychO9]

Looks like the package has a stable tag now.