Upgrade brace-expansion NPM package due to security issue

What does this MR do?

Fixes a security issue in the brace-expansion package as reported on Gemnasium.

The upgrade to jQuery 3 (which fixes some other security issues) is ongoing in https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/11812

Are there points in the code the reviewer needs to double check?

brace-expansion only has minor changes so hopefully this shouldn't break anything.

Does this MR meet the acceptance criteria?

• Changelog entry added, if necessary
• Documentation created/updated
• API support added
• Tests added for this feature/bug
• Review
  • Has been reviewed by UX
  • Has been reviewed by Frontend
  • Has been reviewed by Backend
  • Has been reviewed by Database
• Conform by the merge request performance guides
• Conform by the style guides
• Squashed related commits together

What are the relevant issue numbers?

https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/13588
https://gitlab.com/gitlab-org/gitlab-ce/issues/33888