fix(deps): collapse minimatch onto 10 to clear brace-expansion advisory

[Musiker15]

Follow-up to #219, which patched brace-expansion within each major line. That cleared GHSA-3jxr-9vmj-r5cp but not GHSA-mh99-v99m-4gvg: the second advisory is only fixed in 5.0.8 and flags the entire range at or below 5.0.7, which in semver terms includes the freshly patched 1.1.16 and 2.1.2.

The 1.x and 2.x copies only existed because glob@7 (via archiver-utils and rimraf@2) and readdir-glob@1 (via archiver, which comes from exceljs) depend on minimatch 3.x/5.x. Lifting minimatch itself to 10 removes both: minimatch 10 depends on brace-expansion@^5, so 5.0.8 ends up as the single copy in the tree and the 1.x/2.x overrides become unnecessary.

Why this is safe here. The incompatibility in minimatch 10 is that its CommonJS export is an object rather than a callable, so consumers doing require("minimatch")(...) break. Both of our consumers construct new Minimatch(...) instead. Verified rather than assumed:

• exceljs writes a byte-identical workbook (6625 bytes, same roundtrip values including non-ASCII and brace literals) under minimatch 3.1.5 and 10.2.5.
• glob@7 returns identical results under both versions across literal, *, **, brace, character-class, extglob and dotfile patterns, and Minimatch negation, partial matching, filter and hasMagic behave the same. The only difference is the internal _src regex string, which glob does not read.
• No first-party code imports glob, minimatch or archiver.
• minimatch 10 requires node 20 || >=22; the repo requires >=22.

The lockfile only loses entries (minimatch 3.1.5/5.1.9, brace-expansion 1.1.16/2.1.2, concat-map) and gains none, so the minimumReleaseAge policy is not in play.

Residual risk worth naming: the checks above cover the write path exceljs actually uses. Archiver's glob-driven directory() API is not exercised by exceljs and therefore not covered.