chore(deps): bump undici and brace-expansion past advisories

[GSTJ]

Summary

We bumped the dev-only undici and brace-expansion dependencies past their open advisories (Dependabot alerts #64, #65, #66, #67, #70, #71, #76, #77).

Details

• Both only come in through dev tooling (expo CLI, eslint, jest), so nothing in the published package uses them. Dependabot had not opened PRs for these, so this is one PR.
• Scoped overrides in pnpm-workspace.yaml, same major each time:
  • undici@>=7.0.0 <7.29.1: ^7.29.1 - covers the high (#65) and the rest, lockfile goes 7.29.0 to 7.29.1
  • brace-expansion@<1.1.21: ^1.1.21 - was ^1.1.18, lockfile 1.1.18 to 1.1.21
  • brace-expansion@>=4.0.0 <5.0.12: ^5.0.12 - was ^5.0.9, lockfile 5.0.9 to 5.0.12
• Typed as chore(deps) since it's dev-only and shouldn't cut a release.

Testing steps

No app to click through here. From a fresh clone:

pnpm install --frozen-lockfile && pnpm why undici brace-expansion && pnpm run lint && pnpm run typecheck && pnpm run test && pnpm run build

You should see undici@7.29.1, brace-expansion@1.1.21 and brace-expansion@5.0.12, and everything passing.