Update vulnerable npm dependencies (brace-expansion, diff, fast-uri, nanoid)

[Copilot]

Component Governance flagged several outdated/vulnerable transitive npm dependencies: brace-expansion, diff, fast-uri, and nanoid. diff's major version bump (7 → 8) needed verification since it's a breaking change.

Changes

• diff (7.0.0 → 8.0.3): Bumped the existing overrides.mocha.diff pin in package.json. This is the only place diff's version is constrained — it's a transitive devDependency pulled in by mocha/sinon/ts-node, never imported directly in src/ or webviews/.
• brace-expansion, fast-uri, nanoid: Updated via npm update to the latest versions already satisfying their existing dependents' (minimatch, ajv, postcss) semver ranges — no override needed.

Notes on the diff v8 breaking change

v8 drops ES5 support (uses TextDecoder/Uint8Array, compiles to ES6) and ships its own TypeScript types (dropping @types/diff support). Neither affects this repo:

• No direct diff API usage exists outside string literals (e.g. linkType: 'diff').
• No @types/diff dependency is present.

No new overrides, resolutions, --force, or --legacy-peer-deps were introduced — only the version value of a pre-existing override was updated.

• Fixes Update vulnerable npm dependencies #8956

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.