chore(deps-dev): patch the two advisories dependabot auto-dismissed

[AndresSaa]

What changed

nanoid 3.3.16 → 3.3.18 and brace-expansion 5.0.8 → 5.0.9 in the lockfile. Nothing else.

Both carried high-severity advisories with a patch available, and both are development-scoped, so Dependabot's auto-triage rules dismissed the alerts and never opened a pull request:

Package	Advisory	Vulnerable	Patched	Reached through
nanoid	GHSA-2v37-7h3g-55p8 — infinite loop on zero size	< 3.3.17	3.3.17	tsup → postcss
brace-expansion	GHSA-rgw5-rvv9-x895 — DoS via unbounded intermediate arrays	< 5.0.9	5.0.9	eslint → minimatch

Dismissed is not fixed. The alert stopped being shown; the lockfile kept resolving the vulnerable version, and npm audit kept reporting it on every install.

Why npm update and not npm audit fix

npm audit fix would also have bumped mermaid and dompurify — which is precisely what #43 and #44 already do. Two pull requests editing the same lockfile entries is a conflict for no gain. Both patches here land inside the ranges their parents already declare, so naming the two packages is enough.

This PR and #43/#44 touch disjoint hunks and merge in any order.

How it was tested

npm update nanoid brace-expansion   → 6 insertions, 6 deletions, those two entries only
npm run lint                        → clean (tsc, eslint, prettier)
npm test                            → 69 passed (5 files)
npm audit                           → 2 high resolved; the 2 moderate left are #43/#44

brace-expansion sits under eslint's globbing and nanoid under the tsup build path, so lint and a full build-and-test are the two things that would have noticed a regression. Both are green.

Contract impact

None. Development dependencies only — neither package has ever been reachable from dist, and files ships dist, docs and CHANGELOG.md. No changelog entry: nothing observable changes for a consumer.