chore(deps): upgrade express to v5 in fxa-content-server
Because:
* fxa-content-server uses Express 4.
* Express 5 rejects bare "*" route patterns, and req.host now includes the port.
This commit:
* Bumps express to ^5.2.1 in fxa-content-server and updates yarn.lock.
* Names the settings and HTTP redirect wildcards (/*splat, /{*splat}).
* Uses req.hostname in the HTTP redirect app.
Closes FXA-14788