chore(deps): bump brace-expansion within range (#30)

## Problem

`npm audit` reports 20 dev-only advisories (2 critical, 13 high). The
published package has no dependencies, and `npm audit --omit=dev` is
clean, so none reach n8n users. Dependabot shows only 3 of them (axios,
stream-json, uuid).

## Solution

Lockfile-only: brace-expansion 1.1.18 → 1.1.21 and 5.0.9 → 5.0.12,
within existing ranges. This fixes GHSA-6j4f-fj2g-mc7p (high),
GHSA-qhr7-859c-m2p7 (high) and GHSA-q2hr-2g5m-vwhr. Both versions were
published at least 7 days ago by the same publisher (`juliangruber`),
and their integrity hashes match the registry.

The rest is blocked upstream for now:

- **axios 1.18.0** (12 advisories, incl. Dependabot #37): `n8n-workflow`
pins it exactly. The first release pinning 1.20.0 is 2.43.4, published
2026-10-15. Bump `n8n-workflow` once it is at least 7 days old.
- **handlebars 4.7.9** (2 critical) and **qs 6.15.2**: exact pins inside
`@n8n/node-cli` (through 0.53.1) and `@n8n/backend-network`.
- **stream-json 1.9.1** (#33) and **uuid 10.0.0** (#27): fixes need
cross-major jumps inside `@n8n/node-cli`'s AI-SDK chain.
- **braces**: no patched release exists.

`overrides` would fix most of these, but `n8n-node lint` rejects that
field in community packages (`@n8n/community-nodes/no-overrides-field`).

Note: #29 adds `npm audit --audit-level=high` to `validate`. Until the
upstream pins move, that gate fails on the axios and handlebars highs.

## Testing

CI green on Node 22.22 and 24. Locally, `npm ci` and `npm run validate`
pass: prettier, lint, typecheck, 21/21 tests, `npm audit --omit=dev`,
check-package.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: ehe9991