Resolve braces to @pezkuwi/braces 3.0.4

braces 3.0.3, the latest upstream release, has an open advisory with no
fixed version (CVE-2026-93687: deeply nested patterns exhaust the stack
in its recursive AST walkers). @pezkuwi/braces is a fork that rejects
nesting deeper than maxDepth (500) with a SyntaxError; its tests include
the upstream suite.

package.json

@@ -46,6 +46,7 @@
   },
   "resolutions": {
     "axios": "^1.20.0",
+    "braces": "npm:@pezkuwi/braces@^3.0.4",
     "semver": "^7.5.2",
     "typescript": "^5.5.4"
   }