fix: bump npm to 11.19.0 and patch bundled tar/brace-expansion in gh-aw-node image

Resolves container image vulnerabilities found in ghcr.io/github/gh-aw-node:
- Bump NPM_VERSION from 11.18.0 to 11.19.0
- Add explicit patch of npm bundled tar to >=7.5.22 and brace-expansion to >=5.0.8
- Alpine CVEs (CVE-2026-58055, CVE-2025-60876) addressed by apk upgrade on rebuild

Closes #49295

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: Copilot

.changeset/patch-refresh-gh-aw-node.md

@@ -7,13 +7,16 @@ ARG NODE_IMAGE
 ARG NODE_IMAGE_DIGEST=""
 ARG NODE_IMAGE_UPDATED_AT=""
 ARG DOCKERFILE_HASH=""
-ARG NPM_VERSION=11.18.0
+ARG NPM_VERSION=11.19.0
 
 # Intentional: upgrade all packages to pick up security fixes; downstream digest pins the result.
+# After upgrading npm, patch its bundled dependencies to meet minimum safe versions
+# (tar >= 7.5.21 for CVE-2025-tar, brace-expansion >= 5.0.8 for CVE-2025-brace-expansion).
 RUN apk upgrade --no-cache \
     && apk add --no-cache git \
     && apk info -v | sort \
     && npm install --global "npm@${NPM_VERSION}" \
+    && npm install --prefix "$(npm root -g)/npm" --no-save "tar@^7.5.22" "brace-expansion@^5.0.8" \
     && npm cache clean --force
 
 LABEL org.opencontainers.image.source="https://github.com/github/gh-aw" \