deps: resolve production audit vulnerabilities

[reggi]

Summary

Backports the five dependency updates from #10088 to the npm 11 release branch. Stable patch IDs and git range-diff confirm that each dependency patch is identical to its npm 12 counterpart.

• brace-expansion to 5.0.12
• ip-address to 10.7.2
• postcss-selector-parser to 7.1.6
• undici to 6.29.0
• http-cache-semantics to 4.3.0

Important

Do not squash this PR. The dependency updates are intentionally separated into dedicated commits and preserve the order from #10088.

Validation

• node scripts/resetdeps.js
• node . audit --omit=dev --json reports zero vulnerabilities
• Worktree remains clean after rebuilding vendored dependencies from the committed lockfile
• All five commits have patch IDs identical to deps: resolve production audit vulnerabilities #10088