Bump express-rate-limit to resolve ip-address advisory (#2216)