refactor: Update dependency on cookie to address CVE

[alexvy86]

Description

(Note: currently built on top of https://github.com/microsoft/FluidFramework/pull/22845. Once that merges, I'll update this so only its changes are reflected)

Updates the cookie dependency to address [a CVE in the cookie package](https://nvd.nist.gov/vuln/detail/CVE-2024-47764). This required updating express since it declares a hardcoded (no range) dependency on cookie.

Reviewer Guidance

The review process is outlined on this wiki page.

AB#19026 AB#19027 AB#19028