Set npm minimum release age for dependency updates

[Copilot]

Dependency security updates must avoid newly published npm versions while ensuring brace-expansion remains at a secure version. The lockfile already resolves brace-expansion@2.x to 2.1.4, which satisfies the required >=2.1.3.

• npm policy
  • Configures the repository npm install policy to require package versions to be at least 7 days old.

min-release-age=7

• Dependency scope
  • Leaves dependency resolution unchanged because the existing lockfile already meets the required brace-expansion version floor.

• Fixes Update dependencies with actionable security alerts #1106