brace-expansion override needs per-major ranges, not blanket <3

getsentry/spotlight's blanket pnpm override brace-expansion: >=2.1.0 <3 (meant to patch a CVE) broke build:mac after PR #1335 bumped electron-builder 24→26: app-builder-lib@26.15.7 pulls minimatch@10.2.5, which requires brace-expansion@^5 and calls the NAMED export expand — but the blanket override forced brace-expansion to 2.x, which only has a default export (expandTop), throwing TypeError: (0, brace_expansion_1.expand) is not a function. Trap: a single override range looks like it patches the CVE everywhere, but different consumers (minimatch@3/5/8/9 vs @10) need different majors with different export shapes — pinning one range starves the newer consumer. Fix (PR #1337): four per-major overrides (<2.0.0→>=1.1.12, >=2.0.0<3.0.0→>=2.1.2, >=3.0.0<4.0.0→>=3.0.1, >=4.0.0→>=4.0.1), letting each major resolve to its own patched version. Closes Dependabot #294/GHSA-3jxr-9vmj-r5cp.