chore: Bump brace-expansion to 1.1.16 and 2.1.2

[ernst-dev]

Bumps brace-expansion to patched versions to address a Regular Expression Denial of Service (ReDoS) vulnerability (GHSA-3jxr-9vmj-r5cp, High).

This is a lockfile-only change (transitive dependency; package-lock.json only). Both vulnerable major-version lines present in the tree are bumped:

Instance(s)	From	To	Vulnerable range
brace-expansion (v1 line)	1.1.13	1.1.16	< 1.1.16
glob, readdir-glob, @typescript-eslint/* → brace-expansion (v2 line)	2.0.3	2.1.2	>= 2.0.0, < 2.1.2

• Advisory: GHSA-3jxr-9vmj-r5cp — brace-expansion ReDoS
• Patched versions: 1.1.16 (v1 line), 2.1.2 (v2 line)

The v2-line entries were resolved by npm update; the v1-line entry was pinned to the patched 1.1.16 (identical dependency set, drop-in). Lockfile regenerated with the repo's scripts/clean-package-lock.js post-processing so only brace-expansion entries change.

Opened by roko-dependabot-handler on behalf of @ernst-dev to remediate Dependabot alerts that had no auto-generated fix.