High severity vulnerabilities reported against aurelia-cli (braces version)

A clean setup of just `aurelia-cli` currently returns 12 vulnerabilities (8 moderate, 4 high) that seem tied to the version of braces in use:

```
PS C:\temp> npm install --save aurelia-cli
npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm warn deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm warn deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm warn deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated

added 582 packages, and audited 583 packages in 23s

54 packages are looking for funding
run `npm fund` for details

12 vulnerabilities (8 moderate, 4 high)

To address all issues, run:
npm audit fix

Run `npm audit` for details.
PS C:\temp> npm audit
# npm audit report

braces <3.0.3
Severity: high
Uncontrolled resource consumption in braces - https://github.com/advisories/GHSA-grv7-fg5c-xmjg
fix available via `npm audit fix --force`
Will install aurelia-cli@0.33.1, which is a breaking change
node_modules/braces
chokidar 1.3.0 - 2.1.8
Depends on vulnerable versions of anymatch
Depends on vulnerable versions of braces
Depends on vulnerable versions of readdirp
node_modules/chokidar
glob-watcher 5.0.0 - 5.0.5
Depends on vulnerable versions of anymatch
Depends on vulnerable versions of chokidar
node_modules/glob-watcher
gulp 4.0.0 - 4.0.2
Depends on vulnerable versions of glob-watcher
Depends on vulnerable versions of gulp-cli
node_modules/gulp
aurelia-cli >=0.34.0
Depends on vulnerable versions of gulp
node_modules/aurelia-cli
micromatch <=4.0.7
Depends on vulnerable versions of braces
node_modules/micromatch
anymatch 1.2.0 - 2.0.0
Depends on vulnerable versions of micromatch
node_modules/anymatch
findup-sync 0.4.0 - 3.0.0
Depends on vulnerable versions of micromatch
node_modules/findup-sync
node_modules/matchdep/node_modules/findup-sync
liftoff 2.2.3 - 3.1.0
Depends on vulnerable versions of findup-sync
node_modules/liftoff
gulp-cli 1.3.0 - 2.3.0
Depends on vulnerable versions of liftoff
Depends on vulnerable versions of matchdep
node_modules/gulp-cli
matchdep >=1.0.1
Depends on vulnerable versions of findup-sync
Depends on vulnerable versions of micromatch
node_modules/matchdep
readdirp 2.2.0 - 2.2.1
Depends on vulnerable versions of micromatch
node_modules/readdirp

12 vulnerabilities (6 moderate, 6 high)

To address issues that do not require attention, run:
npm audit fix

To address all issues (including breaking changes), run:
npm audit fix --force
```

This is on an older project, so I'm not looking to migrate it to v2 at this stage to avoid any disruption to the project.

Start by reproducing the reported install and npm audit output, then inspect aurelia-cli's dependency manifest and the dependency chain leading to braces. Done means the supported older CLI can be installed without the reported high-severity braces vulnerability, while avoiding migration to v2.

Written by the indexing model from the issue text.