Update dependency express to v5 (#36041)

This PR contains the following updates:

| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [express](https://expressjs.com/) ([source](https://redirect.github.com/expressjs/express)) | dependencies | major | [`^4.18.3` -> `^5.0.0`](https://renovatebot.com/diffs/npm/express/4.22.1/5.1.0) | `5.2.1` (+1) |
| [@types/express](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/express) ([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express)) | devDependencies | major | [`^4.17.21` -> `^5.0.0`](https://renovatebot.com/diffs/npm/@types%2fexpress/4.17.25/5.0.5) | `5.0.6` |

---

### Release Notes

<details>
<summary>expressjs/express (express)</summary>

### [`v5.1.0`](https://redirect.github.com/expressjs/express/blob/HEAD/History.md#510--2025-03-31)

[Compare Source](https://redirect.github.com/expressjs/express/compare/v5.0.1...v5.1.0)

\========================

-   Add support for `Uint8Array` in `res.send()`
-   Add support for ETag option in `res.sendFile()`
-   Add support for multiple links with the same rel in `res.links()`
-   Add funding field to package.json
-   perf: use loop for acceptParams
-   refactor: prefix built-in node module imports
-   deps: remove `setprototypeof`
-   deps: remove `safe-buffer`
-   deps: remove `utils-merge`
-   deps: remove `methods`
-   deps: remove `depd`
-   deps: `debug@^4.4.0`
-   deps: `body-parser@^2.2.0`
-   deps: `router@^2.2.0`
-   deps: `content-type@^1.0.5`
-   deps: `finalhandler@^2.1.0`
-   deps: `qs@^6.14.0`
-   deps: `[email protected]`
-   deps: `[email protected]`

### [`v5.0.1`](https://redirect.github.com/expressjs/express/blob/HEAD/History.md#501--2024-10-08)

[Compare Source](https://redirect.github.com/expressjs/express/compare/v5.0.0...v5.0.1)

\==========

-   Update `cookie` semver lock to address [CVE-2024-47764](https://nvd.nist.gov/vuln/detail/CVE-2024-47764)

### [`v5.0.0`](https://redirect.github.com/expressjs/express/blob/HEAD/History.md#500--2024-09-10)

[Compare Source](https://redirect.github.com/expressjs/express/compare/v4.22.1...v5.0.0)

\=========================

-   remove:
    -   `path-is-absolute` dependency - use `path.isAbsolute` instead
-   breaking:
    -   `res.status()` accepts only integers, and input must be greater than 99 and less than 1000
        -   will throw a `RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000.` for inputs outside this range
        -   will throw a `TypeError: Invalid status code: ${code}. Status code must be an integer.` for non integer inputs
    -   deps: [email protected]
    -   `res.redirect('back')` and `res.location('back')` is no longer a supported magic string, explicitly use `req.get('Referrer') || '/'`.
-   change:
    -   `res.clearCookie` will ignore user provided `maxAge` and `expires` options
-   deps: cookie-signature@^1.2.1
-   deps: [email protected]
-   deps: merge-descriptors@^2.0.0
-   deps: serve-static@^2.1.0
-   deps: [email protected]
-   deps: accepts@^2.0.0
-   deps: mime-types@^3.0.0
    -   `application/javascript` => `text/javascript`
-   deps: type-is@^2.0.0
-   deps: content-disposition@^1.0.0
-   deps: finalhandler@^2.0.0
-   deps: fresh@^2.0.0
-   deps: body-parser@^2.0.1
-   deps: send@^1.1.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "on the first day of the month" in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate).

GitOrigin-RevId: a677369fcfca7d56937e299e436a7b605dc3e104

Author: convex-renovate-runner[bot]

npm-packages/common/config/rush/pnpm-lock.yaml

@@ -15,7 +15,7 @@
     "commander": "^11.1.0",
     "concat-stream": "^2.0.0",
     "convex": "workspace:*",
-    "express": "^4.18.3",
+    "express": "^5.0.0",
     "node-fetch": "^2.6.1",
     "prettier": "3.6.2",
     "react": "^18.0.0",
@@ -29,7 +29,7 @@
     "@types/archiver": "~7.0.0",
     "@types/aws-lambda": "^8.10.106",
     "@types/concat-stream": "^2.0.3",
-    "@types/express": "^4.17.21",
+    "@types/express": "^5.0.0",
     "@types/node": "^18.17.0",
     "@types/node-fetch": "^2.6.1",
     "@types/uuid": "^10.0.0",