build(deps): patch brace-expansion vulnerability

[GSTJ]

Summary

We replaced the vulnerable brace-expansion version in the development toolchain with the patched 1.1.18 release.

Details

• Pins vulnerable brace-expansion releases below 1.1.17 to a patched version.
• Exempts the minimum fixed version from the repository-wide package age policy so pnpm can install the security update immediately.
• react-native-code-push-plugin stays at 1.0.14 because its published tarball doesn't include this development dependency.

Testing steps

Run:

pnpm install --frozen-lockfile
pnpm audit --audit-level=low
pnpm run test --runInBand
npm pack --dry-run

Confirm the audit reports no known vulnerabilities, the tests pass, and the package tarball builds.

[GSTJ]

Local proof from e3e877e. The full suite and audit pass. The adversarial 1,500-group input stays under the patched memory cap.