How to upcast webform submission in custom routes resp. controller?
You probably just need to declare the parameter type:

confirm:
  path: '/node/{node}/submission/{webform_submission}/confirm'
  defaults:
    _controller: '\Drupal\mymodule\Controller\MymoduleController::confirm'
    _title: 'Confirm your submission'
  requirements:
    _permission: 'confirm webform submission'
  options:
    parameters:
      webform_submission:
        type: entity:webform_submission


The parameter names also need to match, so update your controller accordingly:

public function confirm(EntityInterface $node = null, EntityInterface $webform_submission = null) {