fix: bump brace-expansion to 5.0.6 (GHSA-jxxr-4gwj-5jf2)

[Copilot]

brace-expansion@5.0.5 has a moderate-severity DoS vulnerability (GHSA-jxxr-4gwj-5jf2, CVSS 6.5) where large numeric ranges bypass the documented max protection. Pulled in transitively via typescript-eslint → minimatch@10.2.4.

Changes

• package-lock.json: npm audit fix resolves brace-expansion to 5.0.6 in the typescript-eslint subtree

No package.json changes required. Dev-only impact; nothing vulnerable ships in the built extension.

└─┬ typescript-eslint@8.57.0
  └─┬ @typescript-eslint/typescript-estree@8.57.0
    └─┬ minimatch@10.2.4
      └── brace-expansion@5.0.6  ✓  (was 5.0.5)

npm audit now reports 0 vulnerabilities.