chore(deps): bump minimatch to 9.0.7

[mozilla-blender]

Summary

Bumps minimatch to 9.0.7 to resolve Dependabot alert #140.

This is a transitive dependency update. Only package-lock.json (and possibly package.json) changed.

---

Created by BLEnder investigation via BLEnder

[mozilla-blender]

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

The vulnerable minimatch 9.0.1 is reachable only via node_modules/editorconfig/node_modules/minimatch (editorconfig has no further effects). editorconfig is pulled in by js-beautify, which is pulled in by mjml/mjml-cli/mjml-migrate. The only runtime touchpoint, src/emails/renderEmail.ts, calls mjml2html with beautify:false, explicitly disabling the js-beautify -> editorconfig -> minimatch code path. There are no direct imports of minimatch or editorconfig in the application source. Glob patterns processed by editorconfig come from local .editorconfig files, not user input, so the attacker-controlled-pattern precondition for the matchOne() ReDoS cannot be satisfied.

This PR can be reviewed and merged as a normal dependency update.

[groovecoder]

Dupe of #6666