chore(deps): bump minimatch to 9.0.7

[mozilla-blender]

Summary

Bumps minimatch to 9.0.7 to resolve Dependabot alert #140.

This is a transitive dependency update. Only package-lock.json (and possibly package.json) changed.

---

Created by BLEnder investigation via BLEnder

[mozilla-blender]

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

minimatch 9.0.1 is a deeply transitive dependency: mjml -> js-beautify -> editorconfig -> minimatch. The repo never imports minimatch directly (grep confirms no source code references). The vulnerable code path requires attacker-controlled glob patterns to be passed as the minimatch() pattern argument; in this dependency chain, editorconfig only feeds minimatch the section-header globs read from static .editorconfig files (developer-controlled, committed to the repo), invoked by js-beautify during MJML email pretty-printing. No user/untrusted input ever flows to a minimatch pattern argument. All other minimatch copies in the lockfile are at non-vulnerable versions (3.x, 9.0.9, 10.x). Bumping is still recommended for hygiene since the audit reports a fix is available.

This PR can be reviewed and merged as a normal dependency update.