Fix brace-expansion override for minimatch compatibility

The merge pinned brace-expansion to ^5.0.7 (from master's audit fix), but
5.x is ESM-only with named exports, breaking minimatch@9.0.9 which does a
default import (`import expand from 'brace-expansion'`) — e.g. typedoc's
`doc` script failed. The tree now has both minimatch@9 (needs 2.x) and
minimatch@10 (needs 5.x), so no single major works.

Replace the blanket pin with per-major security patches covering only the
vulnerable ranges (GHSA-v6h2-p8h4-qcjw), letting each consumer resolve its
compatible major: brace-expansion 2.1.2 for minimatch@9, 5.0.7 for minimatch@10.

Author: andreyorst

package.json

@@ -15,7 +15,10 @@
 			"yaml": ">=2.8.3",
 			"picomatch": ">=4.0.4",
 			"file-type": ">=21.3.2",
-			"brace-expansion": "^5.0.7",
+			"brace-expansion@<1.1.12": "1.1.12",
+			"brace-expansion@>=2.0.0 <2.0.2": "2.0.2",
+			"brace-expansion@>=3.0.0 <3.0.1": "3.0.1",
+			"brace-expansion@>=4.0.0 <4.0.1": "4.0.1",
 			"defu": ">=6.1.5",
 			"vite": "^8.1.5",
 			"fast-xml-parser@<5.7.0": ">=5.7.0",