fix: re-land brace-expansion 5.0.9 in app lockfiles (Dependabot) (#24672)

## Summary

Re-lands **#24615** (brace-expansion **5.0.8 -> 5.0.9** in
`examples/hello-world`, `examples/postcard`, `internal/self-hosting`),
clearing **GHSA-rgw5-rvv9-x895** (high) - DoS via unbounded expansion
length causing an out-of-memory process crash, vulnerable `>= 4.0.0, <
5.0.9`. Alerts
[1874](https://github.com/twentyhq/twenty/security/dependabot/1874),
[1876](https://github.com/twentyhq/twenty/security/dependabot/1876),
[1878](https://github.com/twentyhq/twenty/security/dependabot/1878).

## Why again

#24615 merged on 2026-08-22, but #24620 was built on a branch cut before
it: its copies of the same three app lockfiles still carried 5.0.8 and
overwrote the bump when it merged a day later. Nothing intentional -
just the stale-branch lockfile pattern; any branch that reinstalls an
app and merges after a security bump can silently undo it, since app
lockfiles have no conflict to surface (the whole file is regenerated).

Same fix as before: recursive `yarn up -R brace-expansion` per app
(caret ranges `^5.0.2` / `^5.0.5`), **no resolution, no `package.json`
change**.

## Verification

- brace-expansion 5.x resolves to **5.0.9** in all three lockfiles.
- `yarn install --immutable` passes in each.