fix(deps): bump brace-expansion and fast-uri in validation/

[hdamker]

What type of PR is this?

bug

What this PR does / why we need it:

Closes Dependabot alerts #36–#42 by refreshing validation/package-lock.json to patched versions of two transitive dependencies.

Package	Path	From → To	Advisories
brace-expansion	@stoplight/spectral-core → minimatch@3.1.5	1.1.18 → 1.1.21	GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7 (High), GHSA-q2hr-2g5m-vwhr (Medium)
brace-expansion	glob@13 → minimatch@10.2.6	5.0.9 → 5.0.12	same three
fast-uri	ajv@8.18.1	3.1.7 → 3.1.8	GHSA-hrr3-gc8f-f4qj (Medium)

All three targets are within the parents' existing semver ranges, so this is a lockfile-only change (npm update brace-expansion fast-uri --package-lock-only); package.json is unchanged.

Which issue(s) this PR fixes:

(no separate issue — Dependabot alerts auto-close on merge)

Special notes for reviewers:

The alerts appeared when #462 merged, but #462 did not change these packages; the advisories were published on 2026-09-29 and the merge triggered the rescan.

Verification:

• npm ci --ignore-scripts succeeds against the refreshed lockfile
• 1280/1280 validation/ unit tests pass
• npm audit reports 0 vulnerabilities

Changelog input

 release-note
 NONE

Additional documentation

This section can be blank.

docs
NONE