fix(deps): resolve 7 audit advisories in undici and brace-expansion (#79)

pnpm audit reported 7 vulnerabilities (3 high, 2 moderate, 2 low) across two
transitive dependencies:

- undici <6.27.0 via @actions/core > @actions/http-client, 4 advisories
- brace-expansion via rimraf > glob > minimatch, 3 advisories requiring
  >=5.0.6, >=5.0.7 and >=5.0.8 respectively

The existing brace-expansion override pinned ^5.0.5, which predates all three
of its advisories, so it no longer had any effect.

Adds an undici override and raises the brace-expansion override to 5.0.8.
pnpm audit now reports no known vulnerabilities.

brace-expansion is pinned to an exact 5.0.8 rather than ^5.0.8 on purpose:
overrides appear to bypass the workspace's minimumReleaseAge gate, and ^5.0.8
resolves to 5.0.9, which was published within the 7 day window the gate
exists to enforce. 5.0.8 and undici 6.28.0 are both comfortably outside it.

The four action bundles are rebuilt because each one bundles @actions/core, so
the dist diff is the undici 6.24.1 -> 6.28.0 swap and nothing else.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: marc0olo

actions/assemble-docs/dist/index.js

@@ -26,7 +26,8 @@
   },
   "pnpm": {
     "overrides": {
-      "brace-expansion": "^5.0.5"
+      "brace-expansion": "5.0.8",
+      "undici": "^6.27.0"
     }
   }
 }