Replace express-brute

[pjonsson]

This replaces express-brute with rate-limiter-flexible, which removes the dependency on the vulnerable underscore version, and does not have a rate limit bypass vulnerability.