Bump glob to v13 and rollup to v4.59+ to fix security vulnerabilities

Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>

packages/ui/package.json

@@ -64,7 +64,7 @@
     "@types/react-dom": "^18.0.0",
     "@types/use-sync-external-store": "^0.0.6",
     "eslint-plugin-storybook": "^10.3.3",
-    "glob": "^11.0.1",
+    "glob": "^13.0.0",
     "globals": "^17.0.0",
     "react": "^18.0.2",
     "react-dom": "^18.0.2",