Bump brace-expansion override to ^5.0.9

PR feedback (#1223) correctly pointed out
that our ^5.0.8 override still resolved to 5.0.8, which is caught by a
separate advisory (GHSA-rgw5-rvv9-x895) fixed only in 5.0.9+.

Vulnerability count: 35 -> 33.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: gabriel-detassigny

package-lock.json

@@ -123,7 +123,7 @@
     "eslint-import-resolver-typescript": "^3.10.1",
     "serialize-javascript": "^7.0.7",
     "uuid": "^14.0.1",
-    "brace-expansion": "^5.0.8",
+    "brace-expansion": "^5.0.9",
     "webpack-dev-server": "^5.2.6"
   },
   "version": "3.3.5"