ACT-3680: remediate brace-expansion vulnerabilities

[robertvangor]

Summary

• add compatible brace-expansion overrides for the vulnerable 1.x, 2.x, and 5.x dependency paths
• refresh the lockfile to resolve Dependabot alerts Delete .github/workflows/dependency-update.yml #63, feat: added publish to NPM workflow #64, and chore: raise version to 1.3.3 #65 for GHSA-3jxr-9vmj-r5cp

Validation

• Node 20, 22, and 24: npm ci, build, lint, and 158 Jest tests
• Node 20 and 24: coverage (99.39% lines)
• bounded regression probe for each patched brace-expansion major line
• npm pack plus clean consumer install and SDK import
• npm audit: no remaining brace-expansion finding