Bump brace-expansion to 1.1.21 to remediate GHSA-q2hr-2g5m-vwhr

brace-expansion is a dev-only transitive dependency (via eslint).
Add an explicit override floor of >=1.1.21 <2 so the patched release
is required, staying inside the 1.x line.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7a2507e5-5868-45bf-aa18-07670377dbb1

Author: Copilot

package-lock.json

@@ -19,6 +19,7 @@
     "eslint-plugin-json": "^3.1.0"
   },
   "overrides": {
+    "brace-expansion": ">=1.1.21 <2",
     "lodash": ">=4.18.0",
     "js-yaml": "^4.3.2"
   }