Update vulnerable npm dependency paths (#1784)

Component Governance flagged vulnerable `brace-expansion` and `js-yaml`
resolutions in the VS Code feed. This updates the affected npm lockfile
paths while preserving the existing dependency graph shape.

- **Root package lock**
- Updated transitive `brace-expansion` paths to patched `1.x`, `2.x`,
and `5.x` releases.
  - Updated `js-yaml` to `4.3.2`.

- **Nested package locks**
  - Updated matching dependency paths in `api/package-lock.json`.
- Updated matching dependency paths in
`examples/sample1/package-lock.json`.

- **Dependency policy**
- No overrides, resolutions, force flags, or legacy peer dependency
flags added.

<!-- START COPILOT CODING AGENT SUFFIX -->

- Fixes #1783

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: rzhao271 <7199958+rzhao271@users.noreply.github.com>

Author: Copilot