fix(deps): Patch high-severity advisories

[Zee2413]

Summary

• update brace-expansion 1.x to 1.1.18 and 2.x to 2.1.4 in both affected lockfiles
• update js-yaml to 5.2.2 in both affected lockfiles
• update tar to 7.5.21 to resolve an additional critical finding surfaced during validation

Security verification

• all six high-severity Dependabot findings resolve to versions outside their vulnerable ranges
• action: 0 high and 0 critical npm audit findings
• guard: 0 npm audit findings

Validation

• action: formatting, lint, 20 tests, bundle build, and bundle comparison pass
• guard: lint, 5 tests, and TypeScript build pass
• all 16 pull-request checks pass, including cross-platform builds, unit and integration tests, clippy, formatting, fuzzing, and install-script checks