fix(deps): update brace-expansion to 5.0.9

[jeffspahr]

Summary

• update the frontend integration test's brace-expansion override from 5.0.8 to 5.0.9
• refresh the lockfile to the first patched 5.x release for GHSA-rgw5-rvv9-x895 / CVE-2026-69152
• regenerate the existing CommonJS compatibility patch for the secured release

Why

Dependabot alert 3757 reports that brace-expansion versions before 5.0.9 are vulnerable to denial of service through unbounded intermediate arrays. The integration-test dependency tree deliberately overrides legacy minimatch consumers to the 5.x package, so the compatibility patch must move with the version bump.

Verification

• npm ci
• npm audit --omit=dev --audit-level=high (0 vulnerabilities)
• compatibility smoke test covering brace-expansion's callable and named CommonJS APIs plus minimatch 3.x, 5.x, and 9.x consumers
• git diff --check

[google-oss-prow]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from jeffspahr. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• test/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jeffspahr]

/retest