fix(deps): bump brace-expansion to patch CVE-2026-69152

Resolves GHSA-rgw5-rvv9-x895 (high, DoS via unbounded intermediate
arrays) in both vulnerable trees:

- node_modules/brace-expansion: 1.1.17 -> 1.1.18
- node_modules/mocha/node_modules/brace-expansion: 2.1.3 -> 2.1.4

Lockfile-only change; both are transitive deps and the new versions
satisfy the existing ^1.1.7 / ^2.0.2 ranges.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: revopushbot