Fix npm audit vulnerabilities and unblock Renovate lockfile maintenance

[tanem]

Summary

• Sets minimumReleaseAge: null inside lockFileMaintenance in renovate.json, matching the config already proven in tanem/react-svg. The repo-wide 3-day release soak was also applying to weekly lock refreshes; since a full refresh always pulls in something published within the last 3 days, the resulting PR's renovate/stability-days check could never pass. This deadlocked Lock file maintenance #2929 since 2025-11-24 and left 23 transitive dev-dependency alerts unaddressed - the same root cause behind Fix npm audit vulnerabilities #3016 needing to be done by hand in March.
• Bumps @babel/core to 7.29.7 (it's pinned exact, so the lockfile refresh alone couldn't reach the patched version).
• Adds an overrides entry pinning brace-expansion to ^5.0.8, fixing GHSA-mh99-v99m-4gvg (a DoS newly published 2026-07-24) in nested copies that eslint/jest/ts-jest otherwise keep on 1.x/2.x.
• Migrates examples/react-router-v6 to react-router-dom@7.18.2, fixing GHSA-jjmj-jmhj-qwj2 (open redirect leading to XSS), which has no fix in the 6.x line. Renamed the example directory to examples/react-router since the version number is no longer relevant.

npm audit at the repo root now reports 0 vulnerabilities.

The example's npm audit still flags one advisory (GHSA-qwww-vcr4-c8h2, react-router RSC-mode CSRF), but per the advisory itself this "only affects your application if you are using the unstable RSC APIs" - this example is a plain client-side BrowserRouter app and doesn't use them. Its only fix is react-router@8.3.0, but react-router-dom was never republished past 7.18.2 in the v8 line, so actually closing it would mean dropping react-router-dom for the bare react-router package - a separate, larger migration left out of this PR.

Test plan

• npm ci && npm test passes at the root (check:format, check:types, lint, build, all jest configs across the React version matrix)
• npm audit at the root reports 0 vulnerabilities
• renovate-config-validator renovate.json passes
• examples/react-router builds (npm run build) and was verified end-to-end with a headless browser: navigated between all four routes, confirmed the NProgress bar animates on each transition and the HSL/RGB content updates correctly, with no console errors
• Confirm on merge that https://github.com/tanem/react-nprogress/security/dependabot alert count drops
• After merge, close Lock file maintenance #2929 so Renovate recreates it against the fixed config (it's marked immortal) and confirm the recreated PR has no pending renovate/stability-days check

🤖 Generated with Claude Code