chore: Bump brace-expansion to 1.1.16 and 2.1.2

[ernst-dev]

Bumps brace-expansion to patched versions to address a Regular Expression Denial of Service (ReDoS) vulnerability (GHSA-3jxr-9vmj-r5cp, High).

Lockfile-only change (transitive dependency; package-lock.json only). Both vulnerable major-version lines present in the tree are bumped:

Line	From	To	Vulnerable range
v1 (brace-expansion)	1.1.12	1.1.16	< 1.1.16
v2 (glob, readdir-glob, test-exclude → brace-expansion)	2.1.0	2.1.2	>= 2.0.0, < 2.1.2

• Advisory: GHSA-3jxr-9vmj-r5cp
• Patched versions: 1.1.16 (v1), 2.1.2 (v2)

The v2-line entries were resolved by npm update; the v1-line entry was pinned to the patched 1.1.16 (identical dependency set, drop-in). Only brace-expansion entries change; @cloudscape-design/* self-packages are kept stripped to match the committed lockfile format.

Opened by roko-dependabot-handler on behalf of @ernst-dev to remediate Dependabot alerts that had no auto-generated fix.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.01%. Comparing base (200073b) to head (048a36d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #236   +/-   ##
=======================================
  Coverage   99.01%   99.01%           
=======================================
  Files          44       44           
  Lines        1314     1314           
  Branches      364      363    -1     
=======================================
  Hits         1301     1301           
  Misses         12       12           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.