chore(deps): fix vulnerable dev dependencies

[John Kennedy (jkennedyvz)]

Summary

• update vulnerable brace-expansion lockfile entries to 1.1.16, 2.1.2, and 5.0.7
• update vulnerable js-yaml lockfile entries to patched releases
• add a targeted Yarn resolution so Jest's transitive js-yaml dependency resolves to 3.15.1, addressing GHSA-5p4m-2wfm-xmqj / Dependabot alert Long-term Memory (User Profile) #383 without downgrading the independent 4.x dependency

Verification

• yarn install --frozen-lockfile --ignore-scripts in libs/cli/js-examples
• yarn why js-yaml confirms Jest's transitive copy is 3.15.1 and the independent copy remains 4.3.0
• yarn audit --groups dependencies reports no js-yaml findings
• yarn format:check in libs/cli/js-examples
• yarn install --frozen-lockfile --ignore-scripts --ignore-engines in both affected example projects (earlier commit)
• yarn build passes in libs/cli/js-monorepo-example (earlier commit)
• yarn build in libs/cli/js-examples remains blocked by the pre-existing TypeScript error in tests/graph.int.test.ts: input is not a valid update property
• git diff --check