fix: bump brace-expansion + picomatch to patched versions (S360 CVEs)

[jbujula]

Summary

Closes 4 PPBT S360 work items on KPI 240c2bea-0698-48c7-8e78-f9beac31a861 (BIC Component Governance - Low/Medium action items):

ADO	Package	S360 target	This PR
AB#6364952	brace-expansion 1.1.12	1.1.13 (CVE-2026-33750)	1.1.15
AB#6364953	brace-expansion 2.0.2	2.0.3 (CVE-2026-33750)	2.0.3
AB#6364954	picomatch 2.3.1	2.3.2 (CVE-2026-33672)	2.3.2
AB#6364955	brace-expansion 5.0.4	5.0.5 (CVE-2026-33750)	5.0.6

Bonus coverage on AB#6408700 (brace-expansion 5.0.4 → 5.0.6, CVE-2026-45149) — same 5.x paths.

Mechanism

package.json overrides

• Existing brace-expansion: "^2.0.3" direct dep fixes the hoisted root 2.x.
• Added "minimatch": { "brace-expansion": "^5.0.6" } — overrides every minimatch's brace-expansion to ≥5.0.6, fixing glob, mocha, readdir-glob, tfx-cli.

Lock-file patches for inBundle: true paths

npm overrides do not reach packages marked inBundle: true (memory: dependency hard rules). Manually updated:

• node_modules/@microsoft/powerplatform-cli-wrapper/node_modules/brace-expansion: 5.0.4 → 5.0.6
• node_modules/minimatch/node_modules/brace-expansion (azure-pipelines-task-lib bundled): 1.1.12 → 1.1.15
• node_modules/picomatch (inBundle=true): 2.3.1 → 2.3.2

Each patch includes the npm-published `integrity` hash.

Result

All brace-expansion entries in `package-lock.json`:

• 1.1.15 (was 1.1.12)
• 2.0.3 (was 2.0.2)
• 5.0.6 (was 5.0.4, 4 paths)

All picomatch entries:

• 2.3.2 (was 2.3.1, inBundle path)
• 4.0.3 (already current, unchanged)

Test plan

• `npm audit` no longer reports brace-expansion or picomatch findings
• compile + lint + restore (pac CLI 2.7.4) pass
• CI on PR — full pipeline including unit tests on Node 20 (local Node 24 has a pre-existing ts-strip incompatibility unrelated to this change)

Not in this PR

• AB#6420216 (uuid 3.4.0 → 11.1.1, CVE-2026-41907): area path is Deployment Hub\Admin, routed to a different team's queue.

🤖 Generated with Claude Code