Fix brace-expansion DoS vulnerability (GHSA-3jxr-9vmj-r5cp)

[AndreaGriffiths11]

Summary

• Bumps transitive brace-expansion to patched versions via npm update, closing Dependabot alerts #119, #128, #129
• All three affected version lines (1.x, 2.x, 5.x) present in the lockfile are updated: 1.1.13/1.1.14 → 1.1.16, 2.0.3 → 2.1.2, 5.0.5 → 5.0.7
• No source or package.json changes — lockfile only

Test plan

• npm run compile succeeds
• npm run lint — no new errors (pre-existing warnings only)
• npm test — 67/67 tests pass

[github-actions]

🤖 Proof Agent Verification

⏭️ SKIPPED

SKIP: Only 1 file(s) changed, no sensitive files detected.
Use --force or run manually to verify anyway.

---

Proof Agent requires ≥3 files changed or sensitive files to trigger verification. Use --force to verify anyway.

🔗 View logs

[github-actions]

🔍 Extension Quality Check Results

Validation Status

• TypeScript Compilation: ✅ Passed
• ESLint Quality Check: ✅ Passed
• Extension Packaging: ✅ Passed
• Configuration Check: ✅ Passed

📦 Extension Details

• Generated VSIX: teamxray-2.1.2.vsix

🎯 Next Steps

✨ This PR is ready to merge! The extension builds successfully and passes all quality checks.