fix: upgrade shell-quote and brace-expansion (Dependabot #34, #35)

[chriselsen]

Summary

Resolves two Dependabot alerts for transitive devDependencies pulled in via npm-run-all:

• 2019/07/18/aws-site-2-site-vpn-with-strongswan-frrouting/ #34 shell-quote <= 1.8.4: parse() uses Array.prototype.concat in a
  reduce, making it O(n²) in token count. A ~256KB input can block the event
  loop for ~57s. Fixed by pinning the override to 1.9.0, which replaces the
  quadratic reduce with a linear push-based flatten.
• 2020/09/11/aws-ipsec-vpn-ipv6/ #35 brace-expansion < 1.1.16: expand() recurses into post before
  its early-return branches, causing O(2ⁿ) behavior on consecutive
  non-expanding {} groups (~90 byte input can hang for minutes). Added a
  new override pinned to 1.1.17 (the 1.1.16 fix still had a separate high
  severity DoS via unbounded expansion length, flagged by npm audit, which
  1.1.17 resolves).

Both packages are only reachable through devDependencies
(npm-run-all -> shell-quote, npm-run-all -> minimatch -> brace-expansion),
so there's no production/runtime exposure, but Dependabot flags them and
they're cheap to fix.

Pinned to exact patched versions rather than open ranges (e.g. >=1.1.16)
to avoid npm resolving brace-expansion's unrelated 5.x major line, which has
a different API than the 1.x line minimatch depends on.

Changes

• package.json: shell-quote override changed from >=1.8.4 to 1.9.0;
  added brace-expansion override pinned to 1.1.17.
• package-lock.json: updated accordingly (kept lockfileVersion: 2, no
  unrelated transitive bumps).

Testing

• npm install completes cleanly (2 packages added, 45 removed, 55 changed).
• npm audit reports 0 vulnerabilities.
• No application code touched; this only affects local build tooling
  (npm-run-all dev scripts), not the published site.