[HIGH] Bump picomatch patch releases

[OskarEichler]

Summary

• update picomatch 2.3.1 to 2.3.2
• update picomatch 4.0.3 to 4.0.7
• retain every existing semver selector and change only the lockfile

Security impact

The locked releases are affected by GHSA-c2c7-rcm5-vvqj, a high-severity ReDoS in extglob quantifier handling, and GHSA-3v7f-55p6-f55p, an incorrect glob-matching issue caused by method injection in POSIX character classes. Both affected major lines are moved to fixed releases.

Verification

• yarn install --frozen-lockfile --ignore-scripts
• yarn why picomatch confirmed only 2.3.2 and 4.0.7
• yarn audit no longer reports picomatch advisories
• yarn build
• yarn lint
• React Native Codegen: 64 suites, 3,129 tests, 1,279 snapshots passed
• git diff --check

[github-actions]

Warning

Missing Test Plan

Please add a "## Test Plan" section to your PR description. A Test Plan lets us know how these changes were tested.

Caution

Missing Changelog

Please add a Changelog to your PR description. See Changelog format