Patch brace-expansion ReDoS (SNYK-JS-BRACEEXPANSION-17706650)

[juliasilge]

Re-resolve the transitive brace-expansion dependency to patched versions (1.1.15, 2.1.1, 5.0.7) within each major line, closing the ReDoS advisory across all dependency paths (minimatch via vscode-languageclient, eslint, exceljs, tsup, @vscode/test-cli, and pinyin's optional nodejieba).

This supersedes the Snyk PRs (#1028, #1029, #1030, #1031), each of which proposed a major-version bump of a top-level dependency to shift a single transitive path off the vulnerable package. The lockfile re-resolution fixes every path at once with no VS Code engine bump, no eslint flat-config migration, and no pinyin segmentation change.

• Closes [Snyk] Security upgrade vscode-languageclient from 8.1.0 to 10.0.0 #1028
• Closes [Snyk] Security upgrade eslint from 7.32.0 to 10.0.0 #1029
• Closes [Snyk] Security upgrade vscode-languageclient from 8.1.0 to 10.0.0 #1030
• Closes [Snyk] Security upgrade pinyin from 2.11.2 to 4.0.0 #1031

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cscheid]

Yup, all looks good from here, though I haven't recompiled or retested the extension. None of these are "real" in any concrete sense, since ReDOS is about resource exhaustion under adversarial inputs, and if people want to crash their own machines with the extension, there's much simpler ways to go about it...