GHSA-rgw5-rvv9-x895: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

Both intermediate arrays are now bounded as they are built, using the same limits already applied in combine(): values now tracks a running result count and character length while alternatives are appended and stops once either bound is reached, and expandSequence() now accepts maxLength and stops generating once the sequence's own characters reach it. Output is truncated rather than allowed to grow without bound, matching how the existing max limit already behaves.