Bump brace-expansion to fix GHSA-f886-m6hf-6m8v in /.github/actions/upload-artifact-s3 (#8038)

## Summary

Patches the regex-DoS in `brace-expansion`
([GHSA-f886-m6hf-6m8v](GHSA-f886-m6hf-6m8v)
/ CVE-2026-33750) inside `.github/actions/upload-artifact-s3` by
upgrading the transitive `brace-expansion` dependency:

- `1.1.11` → `1.1.14`
- `2.0.1`  → `2.1.0`

`brace-expansion` reaches this action's runtime through `@actions/glob`
→ `minimatch` → `brace-expansion` and is inlined into the action's
bundled entrypoint by `@vercel/ncc`.

## Changes

1. **`package-lock.json`** — pins both transitive instances of
`brace-expansion` to the patched releases. No `package.json` edits;
nothing in this action's tree depends on `brace-expansion` directly.
2. **`dist/upload/index.js`** — regenerated with `npm run release`
(`@vercel/ncc`). The bundled `brace-expansion` source now contains the
upstream patches:
- `expand()` accepts a `max` option and stops emitting expansions once
that bound is reached.
- The fast-path post-brace probe regex changes from `/,.*\}/` to
`/,(?!,).*\}/`, eliminating quadratic backtracking on dense-comma
inputs.
- Numeric brace step is clamped via `Math.max(Math.abs(step), 1)`, so
`{N..M..0}` no longer infinite-loops.
3. **`__tests__/brace-expansion.test.ts`** — two regression tests
against `minimatch.braceExpand` covering the two patched code paths
(zero-step `{1..3..0}` and dense-comma malformed input). The tests run
against the brace-expansion 2.x copy that ships with the action's direct
`minimatch` dep; the 1.x copy bundled into `dist/upload/index.js`
carries the same upstream patches and is guarded against lockfile/dist
drift by the existing `check-dist` CI job.

Closes T261666678.

Author: izaitsevfb

.github/actions/upload-artifact-s3/__tests__/brace-expansion.test.ts

@@ -0,0 +1,46 @@
+import {describe, expect, it} from '@jest/globals'
+import {braceExpand} from 'minimatch'
+
+// Regression tests for GHSA-f886-m6hf-6m8v / CVE-2026-33750 in brace-expansion.
+//
+// minimatch is a direct runtime dep of this action and pulls in
+// brace-expansion 2.x. The vendored copy bundled into dist/upload/index.js
+// (via @actions/glob -> minimatch -> brace-expansion 1.x) carries the
+// same patches; check-dist guards lockfile/dist drift.
+//
+// Vulnerable versions: brace-expansion <=1.1.13 (1.x) and <=2.0.1 (2.x).
+// Patched versions:    1.1.14 / 2.1.0.
+//
+// On vulnerable versions both inputs below either hung indefinitely
+// (zero-step numeric range) or quadratically backtracked the post-brace
+// regex (dense-comma post). On patched versions both return promptly with
+// the asserted output.
+
+const TIME_BUDGET_MS = 1000
+
+describe('brace-expansion (GHSA-f886-m6hf-6m8v) regression', () => {
+  it('zero-step numeric range expands to a finite, deterministic list', () => {
+    // Vulnerable versions infinite-looped on `{N..M..0}` because the step
+    // was used as-is. Patch clamps via Math.max(Math.abs(step), 1) so the
+    // step degrades to 1 and the range expands deterministically.
+    const start = Date.now()
+    const out = braceExpand('{1..3..0}')
+    expect(Date.now() - start).toBeLessThan(TIME_BUDGET_MS)
+    expect(out).toEqual(['1', '2', '3'])
+  })
+
+  it('dense-comma malformed input does not exhibit ReDoS', () => {
+    // Vulnerable versions matched the post-brace tail against /,.*\}/,
+    // which quadratically backtracks on a long run of commas with no
+    // closing brace. Patch tightens the regex to /,(?!,).*\}/. With no
+    // closing brace anywhere the input is malformed and brace-expansion
+    // returns it unchanged; we assert that to lock in correctness as
+    // well as termination.
+    const dense = ','.repeat(10_000)
+    const input = `{a}${dense}`
+    const start = Date.now()
+    const out = braceExpand(input)
+    expect(Date.now() - start).toBeLessThan(TIME_BUDGET_MS)
+    expect(out).toEqual([input])
+  })
+})