Remove pinned async dev dependency from default package.json

[web-padawan]

This is a transitive dev dependency pinned in package.json:

flow/flow-server/src/main/resources/com/vaadin/flow/server/frontend/dependencies/default/package.json

Line 11 in 51a7bb9

"async": "3.2.6",

It was introduced in #13547, see that PR for comments. There should be no need to pin it, "jake" dev dependency now depends on "async": "^3.2.3" which is not affected by the original vulnerability.