Published version of `@web/dev-server-esbuild` with `"^0.28.1"` constraint to avoid forcing a vulnerable version of `esbuild`

[lgarron]

The esbuild vuln alert is currently forced onto all projects using @web/dev-server-esbuild until a version containing d94a40f is released.

I'ld like to advocate for such a version to be published as soon as possible, so that users of @web/dev-server-esbuild do not have to put in overrides or other workarounds.