[HIGH] Bump brace-expansion patch releases - #58337

Summary

• update brace-expansion 1.1.11 to 1.1.18
• update brace-expansion 2.0.2 to 2.1.4
• update brace-expansion 5.0.6 to 5.0.9
• retain every existing semver selector and change only the lockfile

Security impact

The locked releases are affected by denial-of-service issues including GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, and GHSA-rgw5-rvv9-x895. The updated patch/minor releases contain the upstream fixes for all affected major lines.

Verification

• yarn install --frozen-lockfile --ignore-scripts
• yarn why brace-expansion confirmed only 1.1.18, 2.1.4, and 5.0.9
• yarn audit no longer reports brace-expansion advisories
• yarn build
• full yarn test --runInBand: 245 suites passed, 6,206 tests passed, 1 skipped, 1,721 snapshots passed
• Jest retained a pre-existing open handle after reporting success and was stopped after completion
• git diff --check