Bump esbuild to 0.28

There is a security advisory concerning esbuild 0.27: https://github.com/advisories/GHSA-g7r4-m6w7-qqqr. Since tsup pins it to 0.27, downstream builds can't bump without an override.