chore: resolve dependabot security alerts

[MarshallOfSound]

Safe-only sweep of open Dependabot security alerts. All changes are lockfile-only transitive refreshes within existing semver ranges (yarn up -R), no package.json or resolutions changes.

Resolved

Package	Strategy	Version change
picomatch	yarn up -R (in-range)	4.0.3 → 4.0.4
minimatch	yarn up -R (in-range)	5.1.6 → 5.1.9
minimatch	yarn up -R (in-range)	9.0.5 → 9.0.9
glob	yarn up -R (in-range)	10.4.5 → 10.5.0

Also refreshed as side effects: minimatch 3.1.4 → 3.1.5, glob 7.2.0 → 7.2.3, brace-expansion ^2.0.2 → 2.0.3.

Resolves 7 of 9 open alerts. yarn install --immutable passes.

Flagged (not changed)

• serialize-javascript (6.0.2, via mocha → ^6.0.2): patched version is 7.0.5 and no 6.x backport exists. Every published mocha release (including latest 11.7.5) still depends on ^6.0.2, so the only fix is a cross-major resolutions override — skipped as potentially breaking for this sweep.