Fix Dependabot: pin brace-expansion to >=2.1.2 via npm override

[Copilot]

Dependabot was failing with security_update_not_possible for brace-expansion because @eslint/eslintrc@3.3.6 → minimatch@3.1.5 → brace-expansion@^1.1.7 created an irresolvable conflict — the minimum non-vulnerable version is 2.1.2 but the constraint anchors to the 1.x major.

Changes

• package.json: Added brace-expansion to the existing overrides block, forcing all instances across the dependency tree to ^2.1.2

"overrides": {
  "tmp": "^0.2.5",
  "brace-expansion": "^2.1.2"
}

• package-lock.json: Updated — all 5 previously divergent brace-expansion installs (1.1.13, 2.1.0, 5.0.x) are now unified at 2.1.2

[stephenegriffin]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Merge conflicts resolved in 7e7911a. The overrides section in package.json now includes all entries from main plus the brace-expansion fix.