Resolve npm security advisories

[JohnHeikens]

What changed

• Update brace-expansion from 5.0.7 to 5.0.8 in the VS Code extension lockfile.
• Update fast-uri from 3.1.3 to 3.1.4 in the VS Code extension lockfile.
• Update postcss from 8.5.17 to 8.5.18 in the web IDE lockfile.
• Rebuild the committed VS Code extension bundle so its bundled brace-expansion runtime contains the fixed expansion-length limit.

Why

These are the patched releases for all three open high-severity Dependabot alerts. The lockfile changes are limited to the vulnerable package records, and the generated extension bundle is updated because brace-expansion is included in the published extension runtime.

Impact

All npm audit findings are removed without changing direct dependency ranges. Application behavior is unchanged except for the upstream security limits and URI parsing fix.

Checks

• VS Code extension npm audit: 0 vulnerabilities
• web IDE npm audit: 0 vulnerabilities
• VS Code extension tests: 2 passed
• VS Code extension lint
• deterministic VS Code extension production bundle
• web IDE production build and WebAssembly asset checks
• full ./scripts/test.sh: 124 passed, 0 failed, 0 skipped
• git diff --check