Refresh transitive brace-expansion resolutions to patched releases

[Copilot]

Dependabot could not land a non-vulnerable brace-expansion because the current dependency graph still resolved vulnerable transitive versions through typescript-eslint, @typescript-eslint/*, and exceljs. This updates the lockfiles to the nearest patched releases already allowed by the existing semver ranges, avoiding any major-version reconciliation work.

• Frontend

  • Refreshes the frontend lockfile so the minimatch chain resolves brace-expansion to 2.1.4 instead of 2.0.2.

• Shared

  • Refreshes the shared lockfile so existing ranges now resolve patched brace-expansion releases:
    • 1.1.12 → 1.1.18
    • 5.0.8 → 5.0.9

• Serverless

  • Refreshes the serverless lockfile across the transitive paths introduced by @typescript-eslint/*, typescript-eslint, exceljs, Jest tooling, and related minimatch consumers.
  • Moves vulnerable resolutions to patched releases without changing declared package majors:
    • 1.1.12 → 1.1.18
    • 2.0.2 → 2.1.4

• Representative lockfile change

  "node_modules/brace-expansion": {
    "version": "2.1.4",
    "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz"
  }