fix: bump brace-expansion + picomatch to patched versions (S360 CVEs) (#1399)

Closes 4 PPBT S360 work items on KPI 240c2bea (BIC Component Governance):
- ADO #6364952 brace-expansion 1.1.12 -> 1.1.15 (target 1.1.13, CVE-2026-33750)
- ADO #6364953 brace-expansion 2.0.2 -> 2.0.3 (CVE-2026-33750)
- ADO #6364954 picomatch 2.3.1 -> 2.3.2 (CVE-2026-33672)
- ADO #6364955 brace-expansion 5.0.4 -> 5.0.6 (target 5.0.5, CVE-2026-33750)
- ADO #6408700 brace-expansion 5.0.4 -> 5.0.6 (CVE-2026-45149, same package paths)

Mechanism:
- package.json overrides: minimatch -> brace-expansion ^5.0.6 (handles 5.x paths
  in cli-wrapper, tfx-cli, glob, mocha, readdir-glob).
- package.json existing brace-expansion dep at ^2.0.3 (handles root 2.x hoist).
- Lock-file patches for inBundle: true paths that npm overrides cannot reach:
    - @microsoft/powerplatform-cli-wrapper bundled brace-expansion 5.0.4 -> 5.0.6
    - azure-pipelines-task-lib bundled minimatch@3.x's brace-expansion 1.1.12 -> 1.1.15
    - hoisted picomatch (inBundle=true) 2.3.1 -> 2.3.2

Verification:
- npm audit no longer reports brace-expansion or picomatch findings
- compile + lint + pac CLI 2.7.4 restore pass
- Pre-existing Node 24 unit-test ts-strip incompatibility is unrelated to this change

Author: jbujula

package-lock.json

@@ -86,7 +86,10 @@
     "diff": "^5.2.0",
     "ajv": "^6.12.6",
     "underscore": "^1.13.8",
-    "bn.js": "^5.2.3"
+    "bn.js": "^5.2.3",
+    "minimatch": {
+      "brace-expansion": "^5.0.6"
+    }
   },
   "dependencies": {
     "@microsoft/powerplatform-cli-wrapper": "^0.1.135",