chore(deps): bump express to 5.2.0

Resolves a CI vuln check failure for SNYK-JS-EXPRESS-14157151.
We are not affected by this vulnerability, and the CVE was even
revoked, but this is still the easiest way to resolve this warning.

Author: addaleax