Bump path-to-regexp, express, nanoid

[r100-stack]

Changes

Fixes GHSA-rhx6-c78j-4q9w:

Bumps express (an indirect peer dependency) from 4.21.0 to 4.21.2. This in-turns bumps path-to-regexp from 0.1.10 to 0.1.12 to fix the advisory.

Fixes GHSA-mwcw-c2x4-8c55:

Bumps nanoid@<3.3.8 to 3.3.8 and nanoid@>=4.0.0 <5.0.9 to >=5.0.9. Closes #2366 in favor of this PR since that PR didn't fix the advisory completely (run).

Testing

• Confirmed that the audit is fixed
• CI is passing

Docs

According to pnpm why express and pnpm why path-to-regexp, express and path-to-regexp were only used in a dep workspace (e2e).

pnpm why outputs

pnpm why express	pnpm why path-to-regexp

According to pnpm why nanoid, it is also only used in a dev workspace:

pnpm why output

Thus, no changeset added. But I'm not quite sure if pnpm why's outputs were exhaustive.