chore: override tar to ^7.5.19, brace-expansion to ^5.0.8

[sachinh-amazon]

Issue

Description of Changes

Bumps npm dependency override versions flagged by the nightly Security Scan (Amazon Inspector, code-editor-sagemaker-server target) and regenerates the affected package-lock overrides + OSS attribution.

• tar: ^7.5.16 → ^7.5.19
• brace-expansion (in build-tools/oss-attribution/oss-attribution-generator): ^5.0.6 → ^5.0.8

Testing

• ./scripts/prepare-src.sh code-editor-sagemaker-server applies the full patch series cleanly.
• ./scripts/update-package-locks.sh regenerates lockfiles + OSS attribution for all four targets with no errors.
• Verified resolved tar version in package-lock-overrides/sagemaker.series/package-lock.json is at or above the required fixed version (7.5.22). brace-expansion resolves to 5.0.8 in the build-tool lockfile.

Screenshots/Videos

N/A

Additional Notes

Override-only change; no source/behavior changes. Follows the established finding-override-*.diff pattern. The tar override on this branch uses the branch's existing generator signature (direct-dev + global, root only).

Backporting

The same fix is being raised in parallel against main, 1.0, 1.1, and 1.2. Newer branches (main, 1.2) additionally bump shell-quote and axios, which were only flagged there.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.