fix: upgrade brace-expansion to 5.0.5 (CVE-2026-33750) (#115)

Zero-step sequence causes process hang and memory exhaustion.

Author: jdalton

package.json

@@ -807,6 +807,7 @@
       "@sigstore/core": "3.1.0",
       "@sigstore/sign": "4.1.0",
       "ansi-regex": "6.2.2",
+      "brace-expansion": "5.0.5",
       "chownr": "3.0.0",
       "debug": "4.4.3",
       "execa": "5.1.1",