chore: address Trivy production dependency vulnerabilities (#75)

Bump vulnerable production dependencies/overrides and refresh package-lock.json to clear Plugins develop Trivy findings.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: bigorn0

package-lock.json

@@ -81,6 +81,7 @@
         "simple-git-hooks": "2.13.1"
     },
     "overrides": {
-        "minimatch": "10.2.4"
+        "minimatch": "10.2.4",
+        "brace-expansion": "5.0.8"
     }
 }