INF-1404: clear 11 dev-only Dependabot alerts in one bump (#45)

Bump the `dd-trace` and `express` dev dependencies to their latest minor
version, and move the `qs` override to `^6.16.0`. This closes INF-1404,
INF-1373, INF-1656 and INF-1472 together, because all four packages
arrive through the same two dev dependencies.

`dd-trace` 5.81.0 dropped `protobufjs` and `shell-quote`, so the bump
removes both packages (and `@protobufjs/utf8` under them) from the tree
instead of pinning them to a patched version.

The `qs` story is longer. The `6.14.2` pin went in to fix INF-897, an
`arrayLimit` bypass through comma parsing. That fix only covered a flat
key: 6.15.3 and earlier gate the comma-count check on `isFlatArrayValue`,
so `a[]=,,,,` skips the check and `arrayLimit` never applies. `6.16.0`
removes that gate, and a local check confirms it. Against `arrayLimit` 5
with `throwOnLimitExceeded`, both 6.14.2 and 6.15.3 accept `a[]=` with 25
commas without raising, and 6.16.0 raises. `express` 4.22.2 asks for
`qs ~6.15.1`, which caps below the fix, so the override has to stay. It
now uses a caret so it can pick up later patches without a manual bump.
`npm audit` reports no vulnerabilities.

No runtime dependency changes. `pino`, `pino-http` and `redact-object`
are untouched, and the published tarball is still the 8 files under
`dist/`, so no consumer needs a new release.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: minac

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [Unreleased]
+- Upgrade the `dd-trace` and `express` dev dependencies to their latest minor version.
+- Move the `qs` override to `^6.16.0`. `6.16.0` is the first version that enforces `arrayLimit` on a bracket key, so the earlier `6.14.2` pin only closed half of the bypass. The caret lets the override pick up later patches on its own.
+
 ## [0.6.0] - 2024-11-27
 - Redact specific properties in req and res