fix(deps): patch high-severity brace-expansion, minimatch, picomatch (#349)

bun audit high advisories (all transitive, via eslint-config-next and micromatch):
- brace-expansion 1.1.12 -> 1.1.21 (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895,
  GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7)
- minimatch 3.1.2 -> 3.1.5 (GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74)
- picomatch 2.3.1 -> 2.3.2, 4.0.3 -> 4.0.7 (GHSA-c2c7-rcm5-vvqj)

The lock was migrated from pnpm with exact pins, so a plain bun install does not
re-resolve these; entries edited to the patched versions within their ranges and
verified with bun install --frozen-lockfile.

Co-authored-by: Anthony Ettinger <anthony@profullstack.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: 3 people