rimraf is an unused production dependency in gax and gaxios #8975

Both core/packages/gax (google-gax@5.0.6) and core/packages/gaxios
(gaxios@7.1.3) declare "rimraf": "^5.0.1" under dependencies, but neither
package imports or requires it — the only occurrence of the string rimraf in
either published package is the line in its own package.json.

Because it is a production dependency, every consumer inherits this chain:

rimraf@5 -> glob@10 -> minimatch@9 -> brace-expansion@2.x

brace-expansion <= 5.0.7 is affected by GHSA-3jxr-9vmj-r5cp and
GHSA-mh99-v99m-4gvg. minimatch@9 pins brace-expansion: ^2.0.1, so no
semver-compatible update crosses the advisory threshold. The result is a high
finding in npm audit that consumers cannot resolve without an overrides
entry — we had to add "overrides": { "rimraf": "^6.1.3" } to work around it.

If rimraf is only needed for build or test tooling, moving it to
devDependencies (or removing it) would clear the finding for the entire
downstream ecosystem at no runtime cost.

Minor related note: the repository field of both published packages still
points at googleapis/google-cloud-node-core, which was archived in March 2026.

Happy to open a PR if that direction is acceptable.