chore(deps): Bump express in test utils + e2e apps

[chargome]

Shuold get rid of warnings for vulnerable path-to-regexp version
https://github.com/getsentry/sentry-javascript/security/dependabot/452

Closes #19160 (added automatically)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[github-actions]

Codecov Results 📊

---

Generated by Codecov Action

[github-actions]

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.

Scenario	Requests/s	% of Baseline	Prev. Requests/s	Change %
GET Baseline	9,265	-	8,836	+5%
GET With Sentry	1,809	20%	1,670	+8%
GET With Sentry (error only)	6,112	66%	6,017	+2%
POST Baseline	1,215	-	1,171	+4%
POST With Sentry	607	50%	561	+8%
POST With Sentry (error only)	1,059	87%	1,027	+3%
MYSQL Baseline	3,392	-	3,273	+4%
MYSQL With Sentry	519	15%	369	+41%
MYSQL With Sentry (error only)	2,737	81%	2,733	+0%

View base workflow run

[andreiborza]

q: Do we actually need this dep resolution given we bumped all of the ones we use?

[chargome]

Yeah we have this in transitive deps e.g. with ember cli but this is non-breaking